Before launching a program with HackerOne, or at any point during its lifecycle, it’s helpful to import known vulnerabilities and reports into the platform. This includes both unremediated and resolved issues. Importing this data helps the platform recognize duplicates, surface relevant context to triage teams, and better understand which types of vulnerabilities matter most to your organization.
Use this process to:
Pull in a report that was submitted somewhere other than HackerOne
Add a report on behalf of a researcher, so they can claim it and receive reputation
Migrate findings from another bug bounty platform or vulnerability disclosure program
Bulk-upload results from an internal test, pentest, or automated vulnerability scanner
Keep central vulnerability management in HackerOne when issues originate elsewhere
There are two ways to import:
CSV import — supports researcher attribution and historical report states. Format the file as described below, then contact your CSM or HackerOne representative to run the import. Enterprise customers can set up continuous imports.
API import — self-service via the create report endpoint. Best for scanner and pipeline integrations. Note that the API cannot attribute a report to a researcher or set a historical report state; use CSV import if you need either.
How do I add a report on behalf of a researcher?
Use a CSV import and include either the hacker_username or hacker_email column. HackerOne then sends the researcher an invitation to claim the report, which gives them access to it and makes them eligible for reputation based on how the report resolves. See Claiming Reports for what the researcher sees.
This is not available through the API, reporter attribution is CSV-only.
How do I pull in a report from outside HackerOne?
Add it as a row in a CSV import. Include state and substate to preserve where the report already stands (for example, already triaged or already resolved), and created_at to preserve when it was originally submitted. If the report came from another platform or ticketing system, use reference and view_reference_url to keep a link back to the original.
CSV Formatting
Your CSV file should follow the format listed below:
Note: You don't need to include all columns when importing your vulnerabilities unless you want to provide additional details. But, be sure to include all of the required columns as shown in the table below.
See the tables below to learn which fields are required and what should go underneath each field.
Required fields:
Field | Details | Accepted Values | Example |
title | (Required) The title of the vulnerability report | Any string < 150 characters | Reflected XSS on q parameter at search.example.com |
description | (Required) All information required in order to reproduce the vulnerability and understand the impact. Include any relevant endpoints and parameters. As this is a multi-line field, wrap your input in quotes. | Any multi-line string | "# Summary
The endpoint at
# Steps to reproduce
|
state | (Required) Whether the report is open or closed | The word Open or Closed | Open |
substate | (Required) The specific substate of the report - whether the report is new, triaged, resolved, etc. | You can choose from: new, triaged, needs-more-info, resolved, not-applicable, duplicate | triaged |
created_at | (Required field if the report state isn't closed) The timestamp of when the report was submitted | Timestamp in the format: YYYY-MM-DD
You can also include hours/minutes/seconds in 24-hour format: HH:MM:SS | 2020-09-18 |
Attributing a report to a researcher:
Include one of these to invite the researcher to claim the report. If you provide both, hacker_email takes precedence.
Field | Details | Accepted Values | Example |
hacker_email | (Optional) The email address of the hacker. By including the email address, HackerOne is able to send an invite to the hacker to claim any report they've submitted. | A valid email address | |
Hacker_username | (Optional) The HackerOne username of the researcher. Must match an active HackerOne user — if any username in the file doesn't match, the whole import fails with a list of the ones not found. Case and surrounding spaces are ignored. | A HackerOne username, without the @ | jane_doe |
Optional fields:
Field | Details | Accepted Values | Example |
severity_score | (Optional) The severity rating of the report. | A decimal number between 0 and 10 | 7.2 |
priority | (Optional) The severity rating description label. | You can choose from: none, low, medium, high, critical | medium |
view_reference_url | (Optional) The link to the report in your ticketing system (when the reference URL integration is not set up). | A valid URL | |
reference | (Optional) The reference to the report in your ticketing system. | A string < 255 characters | BBP-1234 |
asset_identifier | (Optional) The asset identifier that can be linked to an asset defined on HackerOne. | A string | ".hackerone.com" |
weakness_name | (Optional) The name of the weakness for the vulnerability. You can choose from HackerOne's subset list from the Common Weakness Enumeration (CWE)list. | A string matching the name from the CWE list | Cross-Site Request Forgery (CSRF) |
triaged_at | (Required field if the report state isn't closed) The timestamp of when the submission was triaged. | Timestamp in the format: YYYY-MM-DD You can also include hours/minutes in 24-hour format: HH:MM | 2020-09-18 |
closed_at | (Optional) The timestamp of when the submission was closed. | Timestamp in the format: YYYY-MM-DD You can also include hours/minutes in 24-hour format: HH:MM | 2020-09-18 |
Common Mistakes
Here are some common formatting details that can break your CSV upload.
(Please double-check to confirm all formatting is correct before sending the CSV)
No formatting (bold, colors, cell merging, wrap text, etc.)
No commas
Do not change the column headers
Title must be less than 150 characters
Multi-line fields in CSV files need to be wrapped in quotes in order to keep their formatting
Dates must be formatted YYYY-MM-DD
Asset identifier name should match the asset in your program scope
Weakness type must match the weakness type title in the HackerOne submission form
All known issues should currently be open and confirmed valid (open, triaged) and should only be related to in-scope assets in your program.
Required fields: title, description, state, substate, created_at, triaged_at