HackerOne bug bounty programs
hackerone.com Updated
HackerOne runs 4 public programs on HackerOne and Sorona; three pay cash, the most up to $15,000 (HackerOne).
- Top reward
- $15,000
- HackerOne
- Programs
- 4
- 3 pay cash
- Targets in scope
- 55
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
4 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
HackerOne
HackerOne · Pays the most of the 4 programs: up to $15,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
HackerOne
HackerOne · Bug bounty |
$15k (highest) | $7,000 (highest) | $1,500 (highest) | $200 (highest) | $15,000 | – | – | 3 hours average | Open |
Jetpack
Sorona · Bug bounty |
– | $375 | $250 | $125 | $375 | Partial | – | – | Open |
|
Disclosure Assistance
HackerOne · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
|
Internet Bug Bounty
HackerOne · Bug bounty |
$2,257 | $1,009 | $297 | $68 | $2,257 | – | – | – | Paused |
-
- Critical
- $15k (highest)
- High
- $7,000 (highest)
- Medium
- $1,500 (highest)
- Low
- $200 (highest)
- First response
- 3 hours average
-
- Critical
- –
- High
- $375
- Medium
- $250
- Low
- $125
- Safe harbor
- Partial
-
- Critical
- $2,257
- High
- $1,009
- Medium
- $297
- Low
- $68
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
55 targets across all 4 programs, each listed once with the programs that cover it. 16 excluded.
-
hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com
Web Critical
Covered by HackerOne
-
https://wiki.xenproject.org/wiki/Xen_Project_Repositories
Source code No bounty
Covered by Internet Bug Bounty
-
Backup and restore, plus the security modules, including brute-force protection and the firewall rules Jetpack installs
Products and areas
Covered by Sorona
-
Front-end output: blocks and Gutenberg extensions, shortcodes and embeds, sharing, carousel, related posts and the contact form, every one of which renders input a visitor can influence
Products and areas
Covered by Sorona
-
https://github.com/Hacker0x01/react-datepicker
Products and areas Critical No bounty
Covered by HackerOne
-
Jetpack's REST endpoints under jetpack/v4, its AJAX handlers, and the capability checks gating both
Products and areas
Covered by Sorona
-
That covers the plugin as a whole rather than a handful of its modules: whatever ships inside Jetpack is what the asset row names
Products and areas
Covered by Sorona
-
The admin surface, meaning My Jetpack and the module settings screens, along with the site data those screens render back
Products and areas
Covered by Sorona
-
The connection to WordPress.com: the XML-RPC surface, token issue and verification, and Jetpack single sign-on
Products and areas
Covered by Sorona
-
The HackerOne asset row reads: asset Jetpack, asset type SOURCE_CODE, eligible for bounty, max severity critical. It is the only source-code asset on Automattic's program.
Products and areas
Covered by Sorona
-
The site-data modules: Stats, Search, Subscriptions, Publicize, Sitemaps, and the sync that ships site content up to WordPress.com
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 16
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
go.hacker.one
HackerOne
-
h1.community
HackerOne
-
hackerone-swag.com
HackerOne
-
info.hacker.one
HackerOne
-
ma.hacker.one
HackerOne
-
support.hackerone.com
HackerOne
-
www.h1.community
HackerOne
-
www.hackeronestatus.com
HackerOne
-
Automattic's other assets: the rest of this program's scope table is Tumblr, WordPress.com, Akismet and MailPoet properties, and Jetpack is the only source-code row on it
Sorona
-
Components no longer in active development, which stay in scope and are explicitly paid less
Sorona
-
Duplicates of an already-reported root cause, since only the first reporter is paid, and related reports may be consolidated into a single payout
Sorona
-
Findings whose evidence is hosted on an external service rather than attached to the report
Sorona
-
Payment blocked by sanctions screening, with reporters carrying their own tax liability
Sorona
-
Reports without a proposed CVSS v3 vector and score, which risk losing the reward regardless of the finding's quality
Sorona
-
Third-party plugins and themes that merely interact with Jetpack
Sorona
-
WordPress, BuddyPress and bbPress core bugs, which the program routes to hackerone.com/wordpress instead of paying here
Sorona
Recent changes
Reward and scope changes across every HackerOne program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under hackerone.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.