Run a Program
Best practices and instructions for running successful engagements
76 articles
- CampaignsOrganizations: Introduction & FAQs about H1 Campaigns
- Industry Best PracticesOrganizations: Recommendations & Requirements for running an excellent security program
- Using the Support PortalOrganizations: Submit a support ticket
- Support & Mediation HoursCustomers: Our Support & Mediation team's business hours
- Spot ChecksOrganizations: Bite-sized engagements you can run on BBPs or Challenges
- TriggersSet up automated actions for certain reports
Automate
Create and manage automations for your program
- Automation Security & Event MappingOrganizations: Learn what access automations have and how to map activity
- Automations OverviewOrganizations: Introduction to and limitations of automations at HackerOne
- Creating and Running AutomationsOrganizations: Learn how to create and run automations for your programs
- SCIM Provisioning for HackerOneOrganizations: Configure provisioning for HackerOne
- SCIM Provisioning for OKTAOrganizations: Configure provisioning for OKTA
- External ConnectorsOrganizations: Streamline your workflows using External Connectors for Automations
Set Up and Manage Programs
Build and operate your programs
- Program Starting PointOrganizations: Set up an account for your organization on HackerOne's platform
- Program TypesOrganizations: Learn about the different program types we offer
- Private vs. Public ProgramsOrganizations: Learn the differences between private and public programs
- Parent/Child ProgramsOrganizations: Create subordinate programs that function together with their parent programs
- VDP vs BBPOrganizations: Learn the difference between Vulnerability Disclosure Programs (VDP) and Bug Bounty Programs (BBP)
- EngagementsOrganizations: Learn what engagements are available to you through HackerOne
- Engagement SettingsOrganizations: Edit settings for your bounty programs
- Organization DropdownOrganizations: Switch between organizations in the platform
- Organization ProfileOrganizations: Your organization profile page
- Pausing Report SubmissionsOrganizations: Pause new report submissions to give you time to address existing reports
- VacationsLet hackers know that your internal security resources will be limited for a bit
- Program Status ReportsOrganizations: A self-service feature that summarizes findings for your BBP and VDP programs
- HomeOrganizations: See at-a-glance insights and upcoming actions for your programs
Assets and Scope
Manage your assets and what hackers can test
- Asset InventoryOrganizations: Manage your attack surface with Asset Inventory
- Asset TypesOrganizations: Asset types HackerOne supports
- Defining ScopeOrganizations: Define which assets you want hackers to hack on and how bounty applies
- Scope Best PracticesOrganizations: Best practices for creating a high-quality scope
- Asset-Based Credential ManagementOrganizations: Allow a hacker access to private areas through credentials
- Asset Details and ScopingOrganizations: Learn how to add assets to your inventory
- Asset Filtering and TaggingOrganizations: Filter and tag assets in your asset inventory
- Asset IntelligenceOrganizations: Automatically discover & track your external assets, identify exposure signals, & receive intelligent suggestions for HackerOne programs.
- Scoping ConsiderationsOrganizations: Considerations that can help enable testing on more difficult assets
- Traffic IdentificationOrganizations: Identify hacker testing traffic at various layers
- Authenticated TestingOrganizations: Providing the proper access for authenticated testing
Rewards and Bounties
Set and manage rewards for vulnerabilities
- Bounty TablesOrganizations: Show how much you are willing to pay for various bugs
- Bounty AutopilotOrganizations: Foster engagement with hackers when vulnerabilities become more scarce
- Importance of Bounty TablesOrganizations: Learn how bounty tables help your program
- Detailed Platform StandardsOrganizations: HackerOne's Platform Standards for assessing rewards for a report
- Reward Competitiveness IndicatorOrganizations: Set competitive reward amounts for your bug bounty engagements
- Spend TrackerOrganizations: Gain insight into spending compared to your entitlement
- Unified Scope & Rewards SetupOrganizations: Use asset tag categories to organize assets in your asset inventory
Hacker Engagement
Manage and engage with hackers
- Top HackersOrganizations: Your Security Page can list the top hackers that disclosed vulnerabilities to your program
- InvitationsOrganizations: How to invite hackers to your program
- Signal RequirementsOrganizations: Set a signal threshold that hackers must reach to submit reports
- Communicating with HackersOrganizations: Tips and best practices for communicating with hackers
- Banning HackersOrganizations: Ban hackers who violate the H1 Code of Conduct
- Escalating Code of Conduct ConcernsOrganizations: Request assistance from HackerOne for hacker code of conduct concerns
- Hacker ReviewsOrganizations: Highlight a key behavior that allows HackerOne to award or assist the hacker accordingly
- Export HackersOrganizations: Learn how to export an overview of hackers in your program.
- Invite PreferencesOrganizations: Customize your program by inviting the right hackers with our self-service invite preferences feature
Users & Permissions
Manage users, groups, and permissions
- UsersOrganizations: Add & manage users in your organization
- GroupsOrganizations: Manage permissions through groups
- User ManagementOrganizations: Manage your team members
- Groups and PermissionsOrganizations: Make customized groups with different access rights on your program
- IP AllowlistsOrganizations: Control which IP ranges team members must be coming from
- Team Member EligibilityConfigure a list of email domains that are eligible to join your program
- PermissionsOrganizations: How permissions are setup on the HackerOne platform
Submissions and Reports
Configure and manage report submissions
- Using MarkdownLearn how to use Markdown syntax
- Keyboard ShortcutsKeyboard shortcuts for navigating reports
- Defining SeverityOrganizations: Learn what defines report severity
- Submit Report FormOrganizations: Customize your report submission form
- CVE RequestsOrganizations: Learn how to request new CVE IDs for your program's vulnerabilities
- Common ResponsesOrganizations: Stop writing the same messages over and over again
- Email ForwardingOrganizations: Set up emails to be forwarded to your HackerOne inbox
- Embedded Submission FormOrganizations: Embed the HackerOne report submission form onto your website
- Reducing NoiseOrganizations: Features to help you reduce noise from low-impact reports
- H1 RemediationOrganizations: Learn how to use H1 Remediation for root cause analysis and additional context discovery.
Program Performance
Monitor your program's health
- Program MetricsOrganizations: Learn how healthy your program is and show hackers
- Response Target IndicatorsOrganizations: HackerOne metrics & indicators for program success criteria
- Response Target MetricsOrganizations: Define targets for four response efficiency metrics
- Setting Response TargetsOrganizations: Customize your program's response targets
- Proof of ComplianceOrganizations: Generate a proof of compliance report for your program on HackerOne
- Bug Bounty Maturity FrameworkOrganizations: A tiered guide to evaluating and strengthening your bug bounty program operations.
- Bounty InsightsOrganizations: Transform historical bug bounty findings into actionable intelligence