HackerOne experience.
March 28, 2016
HackerOne experience.
Score 9 out of 10
Vetted Review
Verified User
Overall Satisfaction with HackerOne
I used HackerOne as a platform to report and verify security related issues on the website. It was used as part of the Security team. It allowed external security researchers to submit reports to us and was also used as means of tracking the issue and if the issue was a legitimate one, award a bounty. It was the primary medium of communication between the researchers and the department.
- Easy to use
- Multiple ways to categorize an issue so that it can be reported efficiently.
- Gives an easy way to track issue and open issues again if they aren't resolved properly.
- A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
- Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
- Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.
- Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
- Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
- It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.
I haven't used any other products as such but I have read about bugcrowd.