Provider at a glance
- Category
- Bug Bounty Platforms
- Entity
- Not verified
- Official website
- hackerone.com
Independent rankingchecked How it works
Details
Scored 60 out of 100 under methodology 2026.10.18, from the evidence read in September 2026.
HackerOne
Bug bounty platform
Bug Bounty Platforms
#6 Overall
Ranked #6 of 7 bug bounty platforms in the published ranking
60
ChainChoice Score
The ChainChoice Score, shown against 100: published scores run from 41 to 99.- High evidence confidence
Is HackerOne right for you?
Right for you if these matter most
- Advertised maximum vs actually paid6/10; the category best is 7
Look elsewhere if these come first
- Fee disclosure & take rate2/10 here; HackenProof scores 5
- Dispute recourse when payment is refused3/10 here; Cyfrin CodeHawks scores 4
- Coverage model & blockchain depth3/10 here; Cantina (Spearbit) scores 8
Not yet tested for your country. Markets it lists: Global.
to test where you can use it.
The rank above is the published one, the same for every reader. Find my best bug bounty platform shows where it lands for you.
What will HackerOne cost you?
Not priced on this basis
- Transactions per year
- 1k
How safe is HackerOne?
- Evidence: verified4 of 4 criteria rest on quoted, sourced receipts. Read September 2026.
- LicenceMiCA (EU): no register record on file here.
Alternatives to HackerOne
Compare all 4- 3Cyfrin CodeHawks7 points above · stronger on fee disclosure (3 against 2)67
- 4Cantina (Spearbit)5 points above · stronger on model depth (8 against 3)65
- 5HackenProof4 points above · stronger on fee disclosure (5 against 2)64
For your setup
Find out if HackerOne fits you
The rank above is the published one — the same for every visitor. Answer the category's questions and this section shows where HackerOne lands for you, which criteria your answers weight up, and which stated needs the record does or does not meet. The published rank stays beside it.
- A few questions
- No account required
- Ranking-blind: no commercial input
- Personalised in under 60 seconds
Find my best bug bounty platformNothing is inferred from clicks, popularity or commercial value.
Why this rank
Why HackerOne ranks #6
Each strength is read from evidence on a 0–10 ladder and weighted as the published methodology states. The 32 objective points these produce (11.0 here) sit inside the score; availability, friction, trust record and measured data add the rest.
4 published criteria · Σ weight 100
CriterionWeightStrength · 0–10ScoreContrib.MedianBestRankEvidence
302+1.924.07#7/7Loading evidence…
303+2.883.07#4/7Loading evidence…
256+4.805.07#2/7Loading evidence…
153+1.445.09#6/7Loading evidence…
Hairline = best in this ranking · tick = its median · a missing bar is "not scored", never zero
Margin−4behind HackenProof, #5
RobustnessHoldsacross a one-point change to each of its 4 criterion scores, the re-run scores 58–62 and stays #6
Evidence4 of 4 scored4 quoted, 4 with a source link
What would move the rank
Each line is the ranking run again with one of HackerOne’s criterion scores changed and every other value held: the smallest whole-point change on that criterion that moves its rank, and where the re-run puts it. Up to 4 climbs and 3 falls are listed, smallest change first. Nothing here is a forecast.
Fee disclosure & take rate 2 → 5 on its ladder · passes HackenProof+366#6 → #4
Dispute recourse when payment is refused 3 → 6 on its ladder · passes HackenProof+366#6 → #4
Advertised maximum vs actually paid 6 → 9 on its ladder · passes HackenProof+365#6 → #5
Coverage model & blockchain depth 3 → 8 on its ladder · passes HackenProof+565#6 → #5
Advertised maximum vs actually paid 6 → 0 on its ladder · Secure3 passes it−651#6 → #7
Smallest climb: fee disclosure & take rate 2 → 5 passes HackenProof, #5.
Strengths
1 from the score dataWhere it leads
Best for readers who weight
- Advertised maximum vs actually paid — 6/10, category best 7/10
Tradeoffs
3 from the score dataWhere it trails
Not for readers who put first
- Fee disclosure & take rate — 2/10 against a category best of 7/10
- Dispute recourse when payment is refused — 3/10 against a category best of 7/10
- Coverage model & blockchain depth — 3/10 against a category best of 9/10
Record watch-outs
- If your risk is a smart contract, this is the wrong platform. HackerOne's strength is web, mobile and cloud attack surface; its crypto flagship remains an exchange programme, not a protocol one. Also note the NDA posture — HackerOne's disclosure guidelines state that "Participation in a private Program is entirely optional and subject to strict non-disclosure by default.", which removes the reputational payoff most independent researchers work for.
- Read again 14 September 2026: the $300M all-time milestone (26 October 2023) remains the last all-time figure located; the recurring platform total is the October 2025 press release's "$81 million, an increase of 13% from last year". The Crypto.com policy excludes protocol-economic classes: "reports operating on theoretical attacks such as governance attacks, incorrect data supplied by third-party oracles, sybil attacks, or lacks of liquidity are not considered valid reports". Mediation is not universal: "HackerOne does not accept Mediation requests for Disclosure Assistance reports or Basic Programs that are not managed by HackerOne" and "Hacker Mediation is only eligible for hackers with >0 signal".
Competitive position
Where HackerOne leads and where it trails
Rank on every objective dimension among the rows scored on it. A criterion in the top third of its pool is listed as a lead, the bottom third as a trail; the middle is neither. Popularity, size and commercial terms are not dimensions.
Availability#1 / 714.0 of 20 · constant here
Published criteria#6 / 78.3 of 30 · best 15.5
Friction#1 / 72.7 of 10 · constant here
Trust record#1 / 73.2 of 8 · constant here
Measured data#1 / 78.3 of 18 · constant here
Where HackerOne leads
- Advertised maximum vs actually paid#2 / 7
Where it trails
- Fee disclosure & take rate#7 / 7
- Coverage model & blockchain depth#6 / 7
Closest alternatives
The 3 nearest rows by score
Nearest by published score in either direction. Each card states the criteria on which the two rows differ and the cost difference under the same scenario inputs; the compare arithmetic below shows why the higher one ranks higher.
HackenProof#5 of 7 · score 64 · 4.0 points ahead
HackerOne leads on
- Dispute recourse when payment is refused3 vs 2
- Advertised maximum vs actually paid6 vs 5
HackenProof leads on
- Fee disclosure & take rate5 vs 2
- Coverage model & blockchain depth5 vs 3
Largest single reason HackenProof is ahead: published criteria (+3.9 display points).Scenario cost: HackenProof has no verified pricing for this scenario.
Cantina (Spearbit)#4 of 7 · score 65 · 5.0 points ahead
HackerOne leads on
- Advertised maximum vs actually paid6 vs 4
Cantina (Spearbit) leads on
- Fee disclosure & take rate4 vs 2
- Coverage model & blockchain depth8 vs 3
Largest single reason Cantina (Spearbit) is ahead: published criteria (+5.2 display points).Scenario cost: Cantina (Spearbit) has no verified pricing for this scenario.
Cyfrin CodeHawks#3 of 7 · score 67 · 7.0 points ahead
HackerOne leads onNo scored criterion
Cyfrin CodeHawks leads on
- Fee disclosure & take rate3 vs 2
- Dispute recourse when payment is refused4 vs 3
- Advertised maximum vs actually paid7 vs 6
Largest single reason Cyfrin CodeHawks is ahead: published criteria (+6.2 display points).Scenario cost: Cyfrin CodeHawks has no verified pricing for this scenario.
Against the leader
79 vs 60 · gap 19.0Why Immunefi ranks above HackerOne
The compare workspace's arithmetic applied to these two rows. Each dimension's share of the gap is its weight × the difference, on the displayed scale — it reproduces the displayed gap of 19.0 to within rounding.
DimensionThisImmunefiGap share
Availability · 23% weight · constant here14.014.0same
Published criteria · 35% weight8.315.5−18.7, worse
Friction · 12% weight · constant here2.72.7same
Trust record · 9% weight · constant here3.23.2same
Measured data · 21% weight · constant here8.38.3same
Published criterionThisImmunefiPoints
Fee disclosure & take rate · w3027−4.80, worse
Dispute recourse when payment is refused · w3035−1.92, worse
Coverage model & blockchain depth · w1539−2.88, worse
Net6079−19.0
Your scenario
HackerOne is not priced for this scenario
The cheapest published tier that covers your usage. List price before any discount; add-ons priced separately are excluded. Change an input and every figure recomputes from the published rate; the published rank does not move.
your cost/yr · default scenario — set your own
Transactions per year · your input1k
Rate read from the provider’s published pricing ↗ on 14 September 2026.
your cost/yrCost is stated as your cost/yr in USD; it is never a yield, never annualised, and it does not enter the score.
Not priced on this basis
Under the default inputs · USDCategory medianNot priced0 of 7 rows priced
Cheapest pricedNone pricedDifference not stated · availability not applied — set your country to filter
7 of 7 rows in this ranking have no verified rate for this scenario and are absent from the median, not counted as free.
Evidence
Evidence read 14 September 2026
One row per published criterion: the page each strength was read from, its source type by domain, the reading date and whether the file and the published table agree. Open a row for the quote and the receipt.
4 of 4 cells scored
Score evidenceVerified4 of 4 criteria reconstruct from receipts
4 of 4 criteria reconstruct from a quoted, sourced receipt equal to the published strength.Public receiptsReading…4 quoted with a source URL
The receipt file has not been read yet.Evidence confidenceHighcoverage and corroboration, never freshness
4/4 criteria scored, with 4 dated sources quoted.RobustnessHoldsrank #6 across every one-point re-run
Whether the position holds when one criterion score is changed by one point and the ranking is run again. It is always a re-run of the ranking, never an estimate.The newest evidence read on the platform is 3 November 2026; this category's reading is older. The scores stand as read on 14 September 2026.
Reading the evidence ledger…
CriterionSourceTypeReadFreshnessStatusReceipt
Fee disclosure & take ratestrength 2 · weight 30Report an error—14 September 2026*
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Dispute recourse when payment is refusedstrength 3 · weight 30Report an error—14 September 2026*
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Advertised maximum vs actually paidstrength 6 · weight 25Report an error—14 September 2026*
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.Coverage model & blockchain depthstrength 3 · weight 15Report an error—14 September 2026*
Unknown
No reading date is recorded for this cell or its category.No receipt
A strength is published but no quote or source page is on file for it.How you can lose money here, and what the ranking scores
- Execution failure (HackerOne 3/10): you get a worse price, later, or nothing.Scored by Dispute recourse when payment is refused · 30%
- Information failure (HackerOne 6/10): the number is wrong or bought, or your data leaks.Scored by Advertised maximum vs actually paid · 25%
Not assessed by this ranking: Liveness failure, Exit failure. A high place says nothing about these; the Methodology tab says what each means. Also scored, as cost, quality or a summary of several families: Fee disclosure & take rate (30%), Coverage model & blockchain depth (15%).
Facts
facts, not scoresWhat the record publishes
- Pricing
- Nothing published. hackerone.com/pricing now redirects to hackerone.com/platform, which lists Hai, H1 Bounty, H1 Agentic Pentest, H1 Continuous Testing, H1 Remediation, H1 AI Red Teaming, H1 Validation, H1 Code, H1 Code Security Audit and H1 Bounty Challenge with no dollar amounts, no plan tiers and no fee percentage. It offers only "Get Started" and "Speak with an expert" ("Our team typically responds within 1 business day"). Fees exist but are unquantified: "The awarded amount, including your applicable fees, will be deducted from your balance immediately." Quote-only.HackerOne — official pricing page ↗ · 14 September 2026
- Prices published in
- USDHackerOne — official pricing page ↗ · 14 September 2026
- Licences held
- Not published
- Compliance level
- partial
- Regulatory note
- Not published
- Supported chains
- Multi-chain
- Markets served
- global
- Primary markets
- Not published
- Restricted markets
- Not published
- Operating limits
- Not published
- Availability note
- Global. HackerOne's Community terms require users not to use the platform "in violation of export control laws or regulations and/or economic sanctions laws and regulations that are imposed, administered, or enforced by the U.S., the U.K., the EU, or any other relevant jurisdiction", without naming countries.
No confirmed legal entity is on file for this record. Nothing is inferred from the brand name.
If something goes wrong with HackerOne: where to complain, and where to report a scam
Loading the routes for your country.
How this page is reviewed
Reviewed means this product in this category was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
Accountable for this review: Mathias Siemonsmeier, Founder.
How we review · Review calendar · Corrections log · How we make money
History
What the record carries
Changes to published ranks are recorded in a ledger; every step and its cause is listed on the rank-history page. The entries below begin with the current verified snapshot, then the methodology versions whose changes applied to this category, newest first.
10 methodology entries
- 14 September 2026Current verified snapshot · methodology 2026.10.18Score 60, #6 of 7. 4 of 4 criteria scored. History starts here; earlier values are not interpolated.
- 10 October 2026
2026.10.8When nothing serves your country, the list shown for reference is the published ranking · platform-wide- fixed The reference list shown when nothing serves your country is the published order with the published scores, and a build check now fails any such list out of that order or with a score the ranking does not publish.
- fixed The explorer prints an overall rank only for a row the published ranking holds; a country entrant such as Coinbase Commerce for US merchants shows no overall rank.
- changed Published orders do not move. Country results change only where nothing serves the country: in India bill pay keeps Bitcoin Well first and now shows Strike second, as published; 35 such runs across all categories and countries now match the published list exactly.
- 10 October 2026
2026.10.6A criterion you require re-scores the rows that meet it · platform-wide- changed The explorer sends each criterion you require, at any band, as fit_required with your other answers; region, licence, chain and fact filters stay filters. On /best, a required criterion joins For you as a marked preference does, which needs your country; Overall stays the published ranking, filtered.
- added Every published criterion has a golden case as the explorer sends it (require:<criterion>), so the order a requirement gives is replayed and gated as the published order is, and a change to it needs an entry here.
- 16 September 2026
2026.09.15Dimension scores carry tenths, and eleven more categories are re-read from primary sources · platform-wide- changed Dimension scores resolve to tenths of a point (O-04b), and weightedTotal is rounded to six decimal places before the order is read. 518 published scores move across 107 categories that were not re-read; none of them moves by more than 4 points, and most move by 1.
- fixed 66 published scores change in the eleven re-read categories, against a verbatim source each. The largest moves are Reflexer RAI (−16), Beefy and Unrekt (−11), Aztec (−10) and Golem (+9) — all of them rows whose sources had moved since their last read.
- changed Published order moves in 38 of 119 categories and three #1s change: smart_contract_audits (Zellic → Certora) and travel_rule_compliance (Sumsub Travel Rule → CodeVASP) on the finer resolution, kyc_compliance (Veriff → Sumsub) on the re-read.
- added availabilitySource (O-04g): for a reader who states a country, a row whose availability in that country rests on a region tag its record gives no source for sorts below every sourced row. It is inert in every order published here, which states no country.
Methodology 2026.10.18, the same published run every visitor sees · receipt bug_bounties:hackerone:2026.10.18:7e2d2873878b
Are you HackerOne? Reply to this verdict, or send evidence, ask for a correction or claim the listing. Every message gets a public ticket number; none of it changes a rank unless a public page or a signed statement supports it.