
Bug bounty programs for businesses
Tap into the skills of the global hacker community to uncover high-risk vulnerabilities faster.
What is Bug Bounty?
A bug bounty is a monetary reward given to ethical hackers for successfully discovering and reporting a vulnerability or bug to the application's developer. Bug bounty programs allow companies to leverage the ethical hacking and security researcher community to improve their systems’ security posture over time continuously. Bug bounties can complement existing security controls by exposing vulnerabilities that automated scanners miss, and incentivize security researchers to emulate what a potential bad actor would attempt to exploit.

Workflows that adapt to your development life cycle
The Hackerone Bug Bounty Platform streamlines workflow orchestration across teams to speed response, reduce risk, and scale your bounty program.
- Integrate and automate bug testing with the security and development tools you use today.
- Fix vulnerabilities faster with remediation guidance and retesting capabilities.
- Create automations that trigger actions based on the criticality of vulnerabilities or service level agreements.

Size up potential threats and take action
Our centralized bug bounty platform dashboard shows you which vulnerabilities pose the greatest risk to your organization.
- Monitor the health of your bounty program in real time with insights across the vulnerability life cycle.
- See how your high-severity issues stack up against your industry's norms.
- Access data that classifies and assigns vulnerabilities using Common Vulnerability Scoring System (CVSS) and Common Weakness Enumeration (CWE).

Skills you need, talent you can trust
Our bug bounty redefines the traditional static, signature-based model of security testing by providing an adversarial perspective on the enterprise IT environment.
- Access experts in cloud, mobile, hardware, IoT and more.
- Select ID-verified and background-checked ethical hackers to cover sensitive internal assets.
- Provide secure, monitored access to sensitive assets using our VPN gateway.

Triage you can count on
HackerOne triage staff communicates with hackers,validates their submissions, removes duplicates, and ranks the remaining vulnerabilities by severity.
- Receive only valid vulnerabilities, eliminate false positives, and streamline remediation.
- Our team manages hacker communications and provides you with actionable reports.
- Fast, accurate, and responsive — just a few words our customers use to describe our triage service.
Want to know how a bounty program can reduce risk?
Tell us about your security testing initiatives and one of our experts will contact you.
Request a live demo
Financial Services: Tips for Bug Bounty Success
Jason Pubal is an appsec director at a large financial services firm. Over the past 2 years, he’s prepared for...
Reddit's Bug Bounty Program Kicks Off: Q&A with Reddit's Allison Miller and Spencer Koch, and Top Program Hacker @RENEKROKA
HackerOne sat down with Reddit’s CISO and VP of Trust, resident Security Wizard, and top hacker to discover...
Costa Coffee prepares for global expansion with bug bounty program
As the coffee chain prepares for global expansion, Costa Coffee joins the likes of Hyatt, Deliveroo, and...