To better manage who is allowed to hack on specific programs, you may issue Credentials to be claimed by invited hackers. These credentials allow hackers access to private areas by granting them a login and password for those specific areas.
Credentials can be granted based on Team or Asset. Your program manager can change this setting.
To manage credentials, go to Engagements, click the kebab menu for the program you’re interested in, then click Settings. Then scroll down to General settings and click Credential management.
Asset-Based Credentials
Asset-based credential management involves downloading a template that contains some pre-filled information about your project. Once you complete and upload the template, credentials will be assigned to the specified hackers.
Programs can download their asset file, modify it, and re-upload their CSV.
CSV Format
When you navigate to the credentials area, you will see an option to first download the template which will auto-populate some of the fields with information from your project. The Asset ID and Asset information are required in the CSV when using Asset-specific credentials. The Assigned To column can be left empty if there is no credential inquiry required, and any hacker can claim the credentials.
Note: For Team-specific credentials, those two categories are not required. See the example below.
Asset ID | Asset | Assigned To | Username | Password |
1 | hacker-john | John | john123 | |
2 |
| Jacob | jingleheimer123 | |
3 |
| Schmidt | johnjacob2 |
Multiple Credentials
Each hacker is allowed to claim one credential. If a hacker needs two logins, such as a regular account and an admin account, then both of those usernames and passwords can be put into the same credential for that hacker to claim.
Credential Inquiry
In the first step of Credential Management, you will select which flow you need. If the program needs specific information about the end-user’s environment to prepare a set of credentials, you can create a credential inquiry. Via the Credential Management page, the program specifies what information you need from hackers and selects the asset for which the information is required.
The hacker provides the information via the program’s Security Page.
When it’s not necessary to request information from the hacker before creating credentials, you can immediately add credentials.
You will see a list of hackers who requested credentials and provided the needed information.
Hacker Assignment
Claiming Credentials
When a program has an asset that does not require information from a hacker, the hacker can claim a credential via the program’s Security Page. Once the hacker claims a credential, it is automatically assigned to them.
Only the hackers with a signal of at least 3 are able to claim credentials in a public program. However, you can choose to assign credentials to hackers who do not meet this requirement.
Requesting Credentials
When a program has a credential inquiry, the hacker can’t immediately claim credentials. First, they need to request credentials and provide the necessary information.
Once the information is provided, the hacker is put on a waiting list until the program manager creates the credentials and assigns the hacker to these credentials.
Credential Assignment
When creating a new credential and assigning it to a hacker via CSV upload, the hacker is removed from the waiting list once the credential is assigned.
As the hacker provides the information, the Program Manager is notified every five days via e-mail. The information given by the hacker shows up in the list on the Credential Management page. From here, you can download the list with credential inquiry responses.
Pre-Assigning Credentials
To assign credentials to hackers, you need to create a CSV file with credentials and put the hacker’s username in the (already provided) Assigned To column. This column can be left empty if no credential inquiry is required, and any hacker can claim the credentials.
When the credential is assigned to a hacker, the hacker is notified. If a hacker is not a whitelisted reporter in the program, an error is raised.
Edit, Revoke, and Delete Credentials
Edit Credentials
If you need to edit a credential, click the edit button on the right side of the table.
Revoke Credentials
Revoking a Credential Manually
If a hacker has violated your guidelines or HackerOne's Code of Conduct, click Revoke next to the hacker's username.
Important: Revoking a credential in HackerOne stops the hacker from viewing it here, but it does not disable the account on your own systems. You must invalidate the account in your own application or identity provider to prevent the hacker from logging in, or from resetting the password when you later recycle the credential for another user.
Automatic Revocation
HackerOne automatically marks a hacker's claimed credentials as revoked when they lose access to your program. This applies in every case:
The hacker leaves your program voluntarily
You remove them from your program's invited hackers
The hacker is banned from your program or organization
The Hacker is banned from the HackerOne platform
As above, this only changes the credential's status in HackerOne. The credential remains valid on your systems until you disable it there.
When this happens, program admins receive an email with the subject line "Revoke [username]'s credentials for [program name]", prompting them to revoke credential access in your own systems. You'll only receive it if the hacker has actually claimed one or more credentials for that program.
Remember to reset the password before recycling a credential for another hacker.
Delete All Credentials
If you want to delete all credentials on all the assets, click the Reset credentials button. This action will delete both the assigned and unassigned credentials.
