HackerOne vs. Hackrate

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

Any scenario where having an ethical hacking program is crucial, but you simply do not have the manpower, capability, or know-how on how to deal with reporters or the reports, or verify if the reported issues are as serious as the reporters say. It's an easy way to offload work from your team to professionals who are always ready to help.

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• Ease of use
• Communication with the Hackrate team
• Well defined rules that were helpful in determining which areas we want to focus on.

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

It's a fantastic service that you can rely on. The only minor inconvenience was the overall usability of the platform itself, but you get used to it after using it a few times. The recap meet with the team was always a fantastic time, and helpful in giving the reports further context.

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized