How monday.com built one of tech's most efficient private bug bounty programs
By embedding the H1 Platform into its SDLC and automating the find-to-fix loop end-to-end, monday.com's small security team punches far above its weight with a 70-80% reduction in report processing effort and 127% above goal on valid reports.
Complex product. Small team. Constantly shifting attack surface.
monday.com is deeply configurable, a platform where even power users don't know every corner. For security researchers operating in pure black-box mode, it's genuinely hard to explore. For a small security team, covering it continuously was harder.
Closed-source code makes black-box research especially challenging
Point-in-time pen tests couldn't keep pace with rapid feature shipping
Pivot to AI platform introduced entirely new vulnerability classes
Business logic flaws and chained attacks require adversarial, sustained testing
A private program running since 2018. Built for depth, not volume.
HackerOne predates monday.com's IPO, most of its security tooling, and much of its current scale. That longevity reflects a deliberate philosophy: curate a focused group of skilled researchers who develop genuine fluency with the platform, rather than opening to volume and noise.
Amit Levy came to monday.com already thinking like an attacker. He spent years earlier in his career on the offensive side. That background shapes how he runs the program: not as a compliance checkbox, but as the sharpest adversarial lens available to a small team.
End-to-end automation
Over time, the team built an end-to-end remediation pipeline that makes the program scalable for a lean team. monday.com built a direct webhook integration between HackerOne and their own platform, so every validated report flows automatically into their R&D workflow without manual handoff.
- H1 Platform triage handles first-pass validation and researcher communication.
- The H1 Platform's agentic validation layer handles second-pass confidence scoring and severity confirmation.
- monday.com's internal agent runs root cause analysis and code-level identification.
- Automated PR creation with suggested fix and developer SLA notification, routed through the webhook integration with monday.com's own platform.
- Security team role becomes review and approval, not manual processing.
This pipeline operationalizes every stage of the find-to-fix loop — from adversarial discovery through validated remediation — without the manual handoffs that make security programs hard to scale.
On top of the program growth, Amit uses the monday.com platform to monitor the following health metrics in live dashboards:
- Researcher engagement: Repeat submission rate as a proxy for satisfaction; SLA compliance on validation and payment.
- Signal quality: Ratio of valid to total submissions; proportion of high and critical severity findings.
- Security assurance velocity: Time from feature launch to first finding, and total researcher effort per feature (actively minimized as an assurance metric).
What’s Next?
As monday.com deepens its AI platform strategy, Amit points out that HackerOne has become even more critical (not less). monday.com is using skilled researchers to learn what prompt injection and jailbreaking look like in practice, at the hands of people who have already figured out how to do it.
"The best way to learn about new AI vulnerabilities is to give HackerOne researchers the opportunity to break us and to teach us." — Amit Levy, Head of AppSec at monday.com
