The Submission Requirements page enables you to set specific requirements for hackers to submit reports to your program. You can:
Require hackers to meet certain signal requirements
Require hackers to have two-factor authentication
Select severity rating options
To access the Submission Requirements page, go to Program Settings > Program > Hacker Management > Submission.
Requiring Two-Factor Authentication
To require hackers to have two-factor authentication enabled before submitting reports to your program:
Go to Program Settings > Program > Submission.
Go to the section on requiring hackers to have 2FA.
Click the toggle so that it's set to Yes.
For Public Programs
Hackers who submitted past reports before 2FA was required can still access and comment on those reports. However, they won't be able to submit any new reports to your program without enabling 2FA.
For Private Programs
Hackers are required to have 2FA enabled to participate and submit reports to a private program. Once you turn this feature for a private program, all hackers without 2FA will be removed from the program and immediately sent an invitation back to the program. Those hackers and future hackers won't be able to accept the invitation until they have 2FA enabled.
Enabling Collaboration
Collaboration enables hackers to split the bounty with other hackers who helped collaborate on a report. This allows each hacker to be rewarded for their findings on the report.
To enable Collaboration for your program:
Go to Program Settings > Program > Submission.
Click the toggle so that it's set to Yes for Enable Collaboration.
Severity Calculation Methods
You can select how you would like hackers to determine the severity of the vulnerability they're reporting.
To set your supported severity calculation methods:
Go to the Severity Rating Options section under Program Settings > Program > Submission.
Select one or more from these options:
Option | Details |
CVSS 3.1 | Hackers can pick the CVSS 3.1 severity calculator when assigning severities to reports reported to your program. This calculator uses the official CVSS 3.1 standard. |
CVSS 3.0 HackerOne | Hackers can pick the CVSS 3.0 severity calculator when assigning severities to reports reported to your program. This calculator implements HackerOne’s custom CVSS 3.0 implementation. |
Manual selection | Hackers can manually pick severities. If you want to use a calculation method other than CVSS then outline it in your policy and let hackers pick the severity using manual selection. |
In some cases, you may see that someone can assign severity types that you no longer support to specific reports. This is intended behavior. When our platform checks what severity calculation methods are supported for a report, it also checks for any severities that have been applied to that report in the past or had been available when the report was first created.
You can also make submitting severities mandatory by checking the Make selecting a severity mandatory when submitting a report checkbox.