HackerOne offers a seamless two-way workflow integration that enables tracking and synchronizing vulnerability reports between HackerOne and GitHub. This means that GitHub users can sync specific workflows from GitHub to HackerOne and vice versa. This integration improves workflow by minimizing the back-and-forth between GitHub and HackerOne.
Reduce time to remediation with automated workflows - Simplify the triage and remediation process with a seamless handoff to your development team.
One-click integration between HackerOne and GitHub - Import the most critical data with one click - and create new GitHub issues in HackerOne with another.
Customize synchronization in both directions - Decide what status changes matter most to your team, and sync from HackerOne to GitHub - or vice versa.
Stay up to date on changes to your GitHub issues and HackerOne reports. This integration will help your teams build in more protection at every step by automatically syncing activities between HackerOne and GitHub. You’ll be able to create a GitHub issue from your HackerOne report with one click and have all the information from the HackerOne report available in GitHub to track progress and take action.
Support for multiple GitHub repositories is only available to Enterprise programs.
Setup
You can install this integration using the steps below or install it directly from the GitHub Marketplace: https://github.com/marketplace/hackerone-for-github.
To set up your integration with GitHub:
Go to Engagements, click the kebab menu for the program you’re interested in, then click Settings.
Click Automations > Integrations.
Click Connect with GitHub.
Click Set up new integration.
Enter a name for your integration.
(Optional) Enter a description.
Click Next.
Click New authentication.
Specify an authentication name and click Create.
Click Authorize Hacker0x01 to give HackerOne access to your GitHub account.
Click Next after seeing that your GitHub account has been connected.
Enter your GitHub username in the Owner field.
Select the name of the repository you want to connect to.
Click Next.
Select which HackerOne report fields you would like mapped to the corresponding GitHub field, then click Next.
Select which actions in HackerOne you’d like to post to GitHub as an event. You can choose from:
Option | Details |
Comments | When someone comments on a report, post an update on the associated GitHub issue. |
State Changes | When someone changes the state of a report, post an update on the associated GitHub issue. |
Rewards | When someone awards or suggests a bounty and/or bonus, post an update on the associated GitHub issue. |
Assignee Changes | When someone assigns a user/group to a report, post an update on the associated GitHub issue. |
Disclosure | When disclosure is requested or a report becomes public, post an update on the associated GitHub issue. |
16. Select which actions in GitHub you’d like to post to HackerOne as an event. You can choose from:
Option | Details |
Comment added | Post an internal comment when someone comments on a GitHub issue. |
When issue closes | You can choose from:
|
17. Click Finish.
You’ll now see your created GitHub integration listed at the top of the page. Click Enable next to your integration to make it live. Enterprise programs can set up multiple GitHub integrations to escalate reports to multiple GitHub repositories.
How it Works
With the GitHub integration, you can:
Create a GitHub issue from your HackerOne report
Link your HackerOne reports to existing GitHub issues
Creating a GitHub Issue
Once your GitHub integration has been set up, create an issue in GitHub from your HackerOne report:
Go to your program’s Inbox and select a report.
Click Edit next to the References field.
Select the correct integration you want to add a reference to.
Click Create.
The HackerOne report will now show as an issue in your GitHub repository.
Comment in GitHub:
How the comment in GitHub shows up on the HackerOne report:
Linking HackerOne Reports to Existing GitHub Issues
To link your HackerOne report to a GitHub issue:
Go to the HackerOne report in your inbox that you want to link to GitHub.
Click Edit next to References.
Click the Link issue tab in the Reference to your issue tracker window.
Select your GitHub integration in the drop-down.
Enter the GitHub issue number in the Reference ID field.
Click Create.
Your HackerOne report will now be linked to the GitHub issue.