The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
A complete guide to getting started on HackerOne: from creating your account to submitting your first vulnerability report. Tips for beginners.
BBLabs
Security Researcher
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
HackerOne is the largest bug bounty platform in the world. It connects companies that want to improve their security with ethical hackers who find and report vulnerabilities in exchange for monetary rewards. Companies like Google, Microsoft, GitHub and many more run active programs on this platform.
HackerOne uses a reputation system that determines your access to programs:
✅ Program with a broad scope (many domains/endpoints)
✅ Fast response time (< 7 days)
✅ Clear bounty table with defined amounts
✅ Active program (recently resolved reports)
❌ Avoid programs that only offer "kudos" (no payout)
❌ Avoid programs with a very limited scope
Before touching anything, read the program's rules:
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
A good report is the difference between your vulnerability being accepted or rejected. Structure your report like this:
❌ "Bug in login"
✅ "IDOR in /api/v2/users/{id}/orders allows access to other users' orders"
Explain what you found, where and why it's a security problem. Be specific.
1. Create two accounts: Account A (attacker) and Account B (victim)
2. Log in with Account B and create an order
3. Log in with Account A
4. Send the following HTTP request:
GET /api/v2/users/ACCOUNT_B_ID/orders
Authorization: Bearer ACCOUNT_A_TOKEN
5. Observe that Account B's orders are returned
Describe what a real attacker could do with this vulnerability. Quantify it if you can: "Affects all X users on the platform", "Allows access to financial data", etc.
Include screenshots, HTTP requests/responses and, if possible, a demonstrative video or GIF.
The key to succeeding on HackerOne isn't being the most technical hacker, but the most methodical and persistent. Start with accessible programs, learn from every report (accepted or rejected), and constantly improve your methodology. Every vulnerability you find will teach you something new.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
Take your reconnaissance phase to the next level with advanced techniques for subdomain enumeration, JavaScript file analysis, GitHub dorking and automation.
What bug bounty is, how a program works step by step, which platforms it runs on (HackerOne, Bugcrowd, Intigriti, YesWeHack), how much you earn, whether it's legal and where to start from scratch.
What bug bounty really pays: average rewards by vulnerability type and severity, what top hunters earn, the reality for beginners and why most people don't make a living from it.