> To the companies: You don’t need HackerOne anymore. The tokens to build your own in-house platform cost less than single year of HackerOne.

You know, the biggest thing that HackerOne delivers is a universal payments system that requires absolutely no efforts from companies. Have you tried to manually pay hackers from around the world? It is a laborious process involving trying to find what providers are compatible and what forms of money go where. It is extremely taxing to handle this. HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency. No amount of tokens solve the accounting problem, and it is foolish to imply otherwise.

Sending the sales team on a paid vacation to a tropical paradise while the engineering product flounders is such a perfect representation of corporate rot it sounds like something out of a Mike Judge movie

I know Joel well and think a lot here is both accurate and well written. I led the Yahoo bug bounty program from 2023-2024 and was involved in it from about 2021. A major event that this glosses over is Covid which also happened right around this time as well. Covid killed travel (and budget) which in turn made it impossible to do the live events. A lot of companies ended up shifting to virtual live events which just never delivered on the same value, scale, or impact.

When COVID restrictions were lifted, travel and t&e budgets just never returned. Layoffs started happening and what were lavish, expensive events just couldn’t happen anymore. Hackerone charged for and likely made a lot of money on these events. I think a lot of what is talked about in the article is true but I think Covid is a big part of the why that led to it.

I reported some exploits on hackerone.

Most got dismissed.

One of them, a remotely triggerable DoS vector got downgraded in severity. I got a token payment from the company, and 7 years later, it is still not marked as resolved.

I doubt my situation is unique.

H1 has probably one of the most incompetent series of CEO's in SV startup history, pretty staggering how poorly the business is run

I have 7.00 signal on HackerOne (the highest it can be), I've never filed a report that was closed as not applicable or spam, and I consistently report highs and critical severity issues which make up just over 70% of my reports.

Yet I still find it next to impossible to get issues resolved.

I'm a software engineer / tech bro by trade, and hacking and CTFs have always been a part time hobby for me, and thus I'm not part of the "elite" who get special treatment in the form of account managers and priority support.

I can't help but feel like I'm becoming an even smaller cog in this corporate machine than before - if you look at H1's website, the hacker community is now just 1/6th of their supposed offering, alongside all of the AI pentesting services.

The hacker community is precisely what this company was built on.

The trajectory that they're on, and the positioning that they're adopting, makes me feel like they're eager to "move on" to something beyond it. The financial incentive is certainly there.

Not only was there significant personal liability, but there had been multiple instances of hackers being criminally charged and sentenced to jail time for finding and reporting security vulnerabilities prior to this.

I don't think this is true, although it's a very commonly-held belief. Dan Goodin (I think?) wrote an article about this a long time ago, and was only able to come up with a few examples, and none of them fit this fact pattern.

https://news.ycombinator.com/item?id=16642155

What is true is that it is much less legally risky to test someone else's computer than it was 10-15 years ago. People forget that's what you're doing when you look for web vulns! The DOJ has had a norm over the past ~many years not to prosecute good-faith vulnerability research, even though strictly speaking it contravenes CFAA directly. But "risky on paper" is the most you could say about doing that kind of testing back in 2010.

All good things don't last forever. A organization or company lasting forever with the same goal/mission while using the same methods is a statistical anomaly.

It got the executives it paid for

This same tale could likely be applied to a lot of VC Funded SaaS....

What happens even a company loses its original mission

They got corpo touched?

Bug bounty programs were overrun with low-effort slop nearly a decade before LLMs were introduced; I can't imagine what they're like now...

money happened. it corrupts all. once there is enough of it going around people lose all senses and just want more.

I am in this space. The reality is that the margins for a Bug Bounty Hunting platform are not good, triage is very expensive specially with all the AI slop that gets submitted now. You can hide it for a long time with VC money, but they need to diversify their product line to continue growing and compete against the AI pentest compagnies (which themselves will also diversify as AI pentest becomes a feature and not the whole product).

Last time I reported a DoS bug to HackerOne, the company behind the bounty tried incite me to commit a crime against them by DoS'ing their servers using the hack I had reported in detail!

I literally showed them their server taking over a minute to respond to my request. I even showed how the delay increased proportionally to the message size... Clearly doing more processing; classic DoS vulnerability... Doesn't leave much to the imagination! But they said they would not pay me anything unless I actually proved that it scaled and caused disruption of their service!

It seemed like they were baiting me into incriminating myself for a crime that they wanted me to commit against them. It's not even the first time that I've been baited by a software company into committing a crime against themselves. I never took the bait though.

Honestly, you could sub the other big Bug Bounty platform for H1 in this post and you’d be still extremely accurate.

I once interviewed there, and it was the weirdest interviews of my life.

They literally asked me to prepare on the company mission and values.

The first round was about generic stuff where nothing much was asked. And ironically, despite transparency being their core mission, they didn't tell me I was rejected until I emailed them about a week later.

I don't understand the controversy at the heart of this post. H1 stated they don't use reports to train LLMs. Then they revealed they were using LLMs to triage reports based on previous reports. These two facts are not necessarily incompatible. It's entirely possible to use an LLM with a db tool installed to triage reports without using the body of the reports as training fodder. The article doesn't give any evidence that this was not the case. It sounds to me more like the OP already disliked H1 (for its sales practices and general enshittification) and the LLM issue was a convenient excuse to make a clean break.

From the customer point of view: at a fortune500 I dealt a LOT with h1 (it was never H1) in the early days. Then we got a CISO who was mostly a showman. And at some point (which match the changes in leadership at h1 the article describes) the reports became all garbage and leadership (CISO and CTO) would talk about h1 hackathons with "top hackers flown from all over the world". Such a joke. The end result of those hackatons were 200 "internal host discovery" that were already reported internaly and teams always dismissed as "not worth fixing" and a single attack vector, usually from a brand new acquisition that was still going trhu onboarding. Pretty much never nothing relevant or actionable.

> Co-founder Michiel Prins was allowed to leave the HackerOne dungeon to perform damage control with this absolute banger of an AI slop response: [...]

Wow, it's like he prompted for the most stereotypically AI response possible. There's a tired trope in every sentence going on for four whole paragraphs! I originally quoted it too but thought better and decided to snip it out because I'm pretty sure it would get my account flagged by HN's AI detection algorithm...

I've disclosed vulns across just about every industry — banking, healthcare, oil & gas, government, cybersecurity, etc -- and to some of the largest companies in the world, OpenAI, Salesforce and Google. I've been doing this for nearly 20 years.

Most of my research starts with: _There is absolutely no way this works_. Then it works.

I've been thinking that a lot more lately.

Companies and hackers are both heavily incentivised to reduce the friction involved in vulnerability disclosure, particularly for large organisations. The platforms are good enough now. They're email in 2007: imperfect, occasionally frustrating, but substantially better than what came before.

They make SLAs possible. They provide structure and administration. Things still go wrong — companies stop responding, analysts drop the ball, hackers can be idiots — but the model basically works.

Decentralising disclosure again would make life significantly harder for individual hackers. We'd end up back on email, probably building email-powered bounty CRMs that consume a small country's worth of tokens just to keep track of everything.

For smaller organisations, though, I wouldn't touch a public bounty platform with a 10-foot pole. Run a private program first (through the platform). Having been on the receiving end of beg bounties, automated scanner output and increasingly AI-generated slop, most smaller security teams simply cannot scale to absorb the noise.

The more interesting way to think about these platforms is that they're becoming the LinkedIn of hacking.

For hackers, the path is fairly straightforward: build a rep through useful -- but oftentimes unsolicited disclosures, get invited onto private programs, and gradually establish a profile with a strong signal-to-noise ratio.

For companies, they're increasingly a recruiting and relationship-building tool.

And for the platforms, I think there's a much larger opportunity for them in community.

They should be significantly better at understanding hackers: what they're good at, what technologies interest them, which industries they understand, and where they're located. Today, that profiling is laughably poor, to the point the questionnaires on areas by these large platforms are out of date by several years.

Then use the data.

Run small, highly targeted events: state- or city-based meetups, lunch-and-learns, product launches, bounty program launches and technical briefings. They don't need huge sponsorship budgets or prize pools. They need the actual community involved. Pay for dinner, sponsor a talk.

A lot of existing events seem to start with companies, sponsorship packages and monetary amounts, then work backwards. I think that's backwards.

As a weekend hacker, I'm far more likely to spend time on a program because something about it is interesting: you're launching an AI feature, handling financial data in a new way, using Node/GCP/a TI-82 calculator, or exposing some weird technical surface I want to understand.

And I'm far more likely to build a useful relationship with a company if I can actually meet the people behind the program. Hackers can provide much better feedback than a semi-generated report, and companies can explain far more than a stale domain list and scope document — which, realistically, we'll be ignoring 99.99% of the time anyway.. Unless it's government. I quite like my freedom.

human slop

tl;dr which begins 3,000 words in: employees were noticed to be leaving and it’s because a “fine tuning from user submissions” ai psychosis of yesteryear, except it’s amusingly happening in 2026 still. Investigation into the veracity of the claims.

I'm surprised someone could get upset at AI triaging of bugs which would save everyone time.

I'm sorry you don't know the difference between training, fine tuning, and context. But definitions matter especially in legalese.