HackerOne Blog

The latest from HackerOne

Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase

September 1, 2026

HackerOne ran Anthropic's Mythos 5 model against its own production code. Here's what a critical RCE finding revealed about AI-accelerated security.

Read Now

All

CTEM

Engineering

Cloud Security

Code Security

Crowdsourced Security

Culture & Talent

Defense in Depth

From the CEO

HackerOne News

Offensive Security

Public Policy

Return on Mitigation

Security Compliance

Security Research

Exposure Management

Code Security

Marketing for Engineers

August 30, 2018

Marketing is "the exchange of goods and services aimed at satisfying the needs and wants...

118 Fascinating Facts from HackerOne’s Hacker-Powered Security Report 2018

August 27, 2018

Another year, another Hacker-Powered Security Report! We pulled out 100 of the report’s top facts—and...

7 Common Security Pitfalls to Avoid When Migrating to the Cloud

August 27, 2018

So you want to move to the cloud. It’s okay. You’re not alone. 96 percent...

Code Security

PR (Public Relations) for Engineers

August 24, 2018

PR (public relations) can be an effective way to drive a lot of awareness around...

Oath Bug Bounty Program Update: $1M in payouts and expansion of the program

August 23, 2018

This blog was written by Oath CISO and Paranoid in Chief Chris Nims and originally...

Code Security

Seven Habits for a More Toxic Code Review Culture

August 17, 2018

Please don't practice any of the following "advice." From junior developer to CTO of a...

Code Security

The Most Overlooked Server Permission Checks

August 17, 2018

After reviewing the code for hundreds of backend server applications, we’ve seen some recurring permissions...

Improve Credential Sharing with Hacker Email Aliases

August 16, 2018

Starting today, all existing and new hackers get a personalized email alias tied to their...

A Guide To Subdomain Takeovers

August 15, 2018

HackerOne's Hacktivity feed — a curated feed of publicly-disclosed reports — has seen its fair...