Signal requirements enable a program to set a signal threshold that hackers must reach to submit reports to the program. If a hacker falls below the threshold, they will have a restricted number of reports they can submit to your program. This will improve the quality of reports programs can expect to receive from hackers.
The signal used for signal requirements is calculated based on a rolling 365-day window. This means that a hacker’s signal is based on their activity from the last 365 days.
To enable Signal Requirements:
Go to Security page > Hacker Management > Submission.
Choose from 1 of these 4 options in the Signal Requirements section:
Option | Details |
Strict | Hackers with a proven record are unrestricted, while hackers who don't meet this requirement will have a limited number of allowed submissions to your program. A strict setting makes sense for teams that prefer fewer, higher-quality reports or that can only handle a smaller flow of reports, as it most tightly limits hacker participation based on high Signal. This is the recommended setting for new programs. |
Standard | The recommended setting for most programs. |
Lenient | Recommended for experienced programs that want to maximize the number of hackers who will help find vulnerabilities. |
Turn off Signal Requirements | Any hacker with any level of Signal will be able to submit reports to your program. Recommended for veteran programs only. |
Note: Turning Signal Requirements down or off is better for teams that value having the maximum number of hackers to help find issues.
Trial reports are counted when a participant does not meet the signal requirements for a program. They are tracked within a 30-day rolling window, and there are limits to the number of trial reports a participant can submit. These are the limits:
When hackers do not meet a program’s signal requirement, their submissions are treated as trial (capped) reports. These hackers can submit a limited number of vulnerability reports within a rolling 30-day window. The number of capped reports resets every 30 days.
Type of Limit | Description | New Hackers (they have less than 5 resolved reports on HackerOne) | Seasoned Hackers (they have more than 5 resolved reports on HackerOne) |
Program Limit | The number of trial reports you're able to submit to a single program. | 4 | 8 |
Platform Limit | The total number of trial reports you're able to submit on the HackerOne platform. | 6 | 12 |
These limits help manage report quality while still giving hackers the opportunity to participate in programs, even if they do not currently meet the program’s signal requirement.