First steps on HackerOne

What is HackerOne?

HackerOne is the largest bug bounty platform in the world. It connects companies that want to improve their security with ethical hackers who find and report vulnerabilities in exchange for monetary rewards. Companies like Google, Microsoft, GitHub and many more run active programs on this platform.

Creating your account

1. Go to hackerone.com and sign up
2. Complete your profile with real information (companies value transparency)
3. Verify your identity so you can receive payments
4. Set up two-factor authentication (2FA) — it's mandatory

Understanding reputation and signal

HackerOne uses a reputation system that determines your access to programs:

• Reputation: Goes up when your reports are accepted, down when they're closed as N/A or duplicate
• Signal: Measures the quality of your reports (percentage of valid vs. invalid reports)
• Impact: Reflects the severity of the vulnerabilities you find

Why does reputation matter?

• Private programs (which tend to have less competition and better rewards) require a minimum reputation to access
• High signal proves that you submit quality reports
• You'll start with 100 reputation points

Choosing your first program

Public vs. private programs

• Public: Anyone can participate. More competition, but ideal to get started
• Private: Invitation only. Less competition, generally better rewards

Criteria for picking a good first program

✅ Program with a broad scope (many domains/endpoints)
✅ Fast response time (< 7 days)
✅ Clear bounty table with defined amounts
✅ Active program (recently resolved reports)
❌ Avoid programs that only offer "kudos" (no payout)
❌ Avoid programs with a very limited scope

Reading the scope is mandatory

Before touching anything, read the program's rules:

• In scope: The domains and features you're allowed to test
• Out of scope: What you must NOT touch (they can ban you if you do)
• Exclusions: Vulnerability types they don't accept
• Rules of engagement: Rate limits, no accessing other real users' data, etc.

Writing a good report

A good report is the difference between your vulnerability being accepted or rejected. Structure your report like this:

1. A clear, descriptive title

❌ "Bug in login"
✅ "IDOR in /api/v2/users/{id}/orders allows access to other users' orders"

2. Description of the issue

Explain what you found, where and why it's a security problem. Be specific.

3. Reproduction steps

1. Create two accounts: Account A (attacker) and Account B (victim)
2. Log in with Account B and create an order
3. Log in with Account A
4. Send the following HTTP request:
   GET /api/v2/users/ACCOUNT_B_ID/orders
   Authorization: Bearer ACCOUNT_A_TOKEN
5. Observe that Account B's orders are returned

4. Impact

Describe what a real attacker could do with this vulnerability. Quantify it if you can: "Affects all X users on the platform", "Allows access to financial data", etc.

5. Evidence

Include screenshots, HTTP requests/responses and, if possible, a demonstrative video or GIF.

Common beginner mistakes

1. Not reading the scope: Reporting vulnerabilities on out-of-scope domains
2. Reporting low-quality issues: Self-XSS, missing headers with no impact, etc.
3. Vague reports: No clear reproduction steps
4. Duplicates: Not checking whether the vulnerability was already reported
5. Being impatient: Triage can take days or weeks
6. Automating without understanding: Firing off scanners without grasping the results
7. Not updating the report: If the team asks for more information, respond quickly

Your first few weeks

1. Week 1: Set up your environment, study the scope of 2-3 programs
2. Week 2: Do manual recon, browse the application like a normal user
3. Week 3: Start testing specific features (registration, profile, APIs)
4. Week 4: If you find something, write a detailed report and submit it

Conclusion

The key to succeeding on HackerOne isn't being the most technical hacker, but the most methodical and persistent. Start with accessible programs, learn from every report (accepted or rejected), and constantly improve your methodology. Every vulnerability you find will teach you something new.