Spot Checks Enhancements
Enhanced Spot Checks functionality with editing capabilities and flexible rewards, giving customers more control and flexibility when managing their spot check campaigns.
What we did:
Added key enhancements to the Spot Checks feature that provide greater flexibility and control:
Editable Spot Checks - Customers can now edit spot checks after creation to correct mistakes or add additional hackers to ongoing spot checks
Flexible Rewards - New reward flexibility allows customers to determine appropriate effort levels and compensation for their specific spot check requirements
Who it helps:
Enterprise customers wanting more control and flexibility in managing their spot checks
Internal teams who no longer need to raise engineering tickets for spot check edits, improving operational efficiency
Documentation:
⚠️ Coming July 29: Enforced 2FA ⚠️
The Change:
Protecting the data of our customers and research community is a top priority. As part of our ongoing commitment to platform security, we are making important changes to our authentication process. Starting July 29, 2025, two-factor authentication (2FA) will be required for all users not using SAML/SSO.Status: Approaching General Availability for ALL users! Customers & Researchers included.
Why are we telling you now?
We are notifying all researchers and customers of the upcoming changes so that users can take proactive action and avoid needing to take additional steps before accessing the platform on July 29.
Summary:
We’ve always offered 2FA, but this change makes 2FA mandatory for all HackerOne platform users not using SSO/SAML to sign in.
What we are doing:
Coming July 29, 2025 - All HackerOne platform users not signing in via SSO will be required to sign in using 2FA.
We have already removed the mandatory requirement of a mobile number from the account recovery process.
Users can now recover their accounts using backup codes. If these are not available, they can contact the support team. In this case, the user will receive a confirmation email and text message (if configured).
Why are we doing it:
This change improves overall platform integrity and brings us into alignment with the expectations of high-value, security-conscious users.
Security parity with peers: Enforced 2FA is now standard for any platform handling sensitive data. Our previous opt-in approach introduced risk.
Customer compliance: High-security orgs (e.g., UK MoD, NCSC) can’t use SSO but need robust MFA for internal compliance.
Support efficiency: Account recovery is harder when users rely on SMS or mobile-only access, especially in environments without personal devices. Platform-native 2FA offers a more dependable path.
Who it helps:
All HackerOne platform users not signing in via SSO/SAML.
How to use it:
Any user can and is encouraged to configure 2FA now by following the instructions detailed here.