This page explains how HackerOne handles source code for offerings that perform AI-powered code analysis:
H1 Code: Continuous agentic security scanning of new code updates.
H1 Code Security Audit: In-depth agentic static analysis of system architecture and code.
H1 Remediation: Agentic root cause analysis and fix verification.
H1 Continuous Testing: Adversarial agentic offensive testing. Source code handling applies when you use optional white-box testing.
Request Code Review: On-demand code review for reported vulnerabilities.
HackerOne applies just-in-time access, data minimization, and least privilege to AI agents that scan your code, just as we do for authorized human access.
Integration Models
HackerOne connects to your source code management (SCM) provider using one of two integration models.
Cloud-Hosted SCM
For GitHub, GitLab, Bitbucket Cloud, and Azure DevOps Services, HackerOne connects directly to your SCM provider through its API using a scoped access token that you provision.
You control which repositories HackerOne can access by configuring the token's permissions at the repository, project, or organization level.
Self-Hosted SCM
For GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center, and Azure DevOps Server, HackerOne provides a lightweight proxy that runs inside your network.
The proxy handles data transport only. AI models, static analysis tools, and code execution engines do not run on the proxy or inside your network.
The proxy connects outbound to HackerOne's backend over HTTPS. You do not need to open inbound ports.
Repository Access
For both integration models, HackerOne uses only source code from repositories you authorize, and only for the time needed to complete analysis tasks.
You control which repositories are in scope and can add or revoke access at any time using your SCM provider's existing permission controls.
Infrastructure Isolation
HackerOne's code analysis system runs in a dedicated Amazon Web Services (AWS) Virtual Private Cloud (VPC), separate from other HackerOne product infrastructure.
Bug bounty programs, vulnerability disclosure programs, penetration testing services, and adversarial AI testing systems each run on isolated infrastructure.
The code analysis VPC connects privately to HackerOne's application platform.
Technical review needed: The source describes this connection as using “contracted request interfaces that are strictly enforced.” Confirm the intended technical meaning before replacing or simplifying this term.
The code analysis system does not share compute, storage, or credentials with other HackerOne services.
How Your Code Moves Through the System
HackerOne limits source code access and storage to what is required for each scan.
1. Source Code Retrieval
When an agentic code scan starts, HackerOne retrieves a point-in-time snapshot containing the repository content required for the analysis.
HackerOne retrieves source code only in response to a specific scan. We do not continuously sync, perform scheduled bulk exports, or replicate source code in the background.
2. Encryption in Transit
All source code transfers use Transport Layer Security (TLS) 1.2 or higher with forward-secrecy cipher suites.
3. Temporary Encrypted Storage
HackerOne stores source code in encrypted form only for the duration of the scan.
Source code is encrypted at rest using AWS Key Management Service (KMS)-managed keys with AES-256 encryption. An automated lifecycle process deletes all source code objects within 24 hours after the scan completes.
4. Isolated Scan Execution
Each scan runs in a dedicated Kubernetes namespace with isolated compute, storage, and credentials.
When the scan finishes, HackerOne destroys the namespace and its associated resources. Separate scans of the same repository do not share pod storage or scratch space.
Technical review needed: The source specifies that HackerOne destroys these resources “atomically.” Confirm whether that distinction is important for the public-facing security claim before removing the term.
5. Results Delivery
HackerOne stores scan findings in your HackerOne program. Findings can include vulnerability reports, severity assessments, and remediation guidance.
The same access controls and data segmentation used for other HackerOne program data also apply to these results.
Raw source code is not retained as part of the scan results.
Access Controls
HackerOne uses several controls to limit access to your source code.
Control | How it Works |
Repository Scope | You choose which repositories HackerOne can access by granting permissions through your SCM provider.
HackerOne can access only repositories that the service account has permission to read. |
Read-Only Access | HackerOne's service does not push commits, create branches, modify settings, or create webhooks. |
Customer-Managed Credentials | You create and rotate the credentials used to access your repositories. For self-hosted integrations, the credential remains inside your network. |
Logged Access | HackerOne personnel may access agentic scan output that includes source code context for activities such as human-in-the-loop (HiTL) oversight.
This access occurs only through audited and logged sessions on HackerOne's internal systems. |
AI Model Security
HackerOne uses models from approved, trusted providers for AI-powered scanning (see subprocessors approved for AI processing activities here).
Technical and contractual safeguards prevent approved model providers from using input or output data to train or improve their own models.
HackerOne does not use your source code to train, fine-tune, or improve AI models. We process source code only to perform the contracted analysis, then delete it according to the retention practices described below.
Source Code Retention and Deletion
HackerOne temporarily caches source code in encrypted form while performing scanning and analysis.
We clear the source code within 24 hours after the analysis tasks are complete.
Supported Integrations
Cloud SaaS Providers
On-premise/Self Hosted Providers
See our On-premise Integration Guide. See product edition and version compatibility below.
Provider | Product(s) | Version(s) |
GitHub | - 2.18 and above - GitHub API v3 | |
GitLab | - 11.0 and above - GitLab API v4 | |
Azure DevOps | - 2019 and above | |
Bitbucket | - 5.5 and above |