HackerOne’s Three-Report Trial Limit Draws Criticism From Veteran Researcher
· 10:41 · Watch on YouTube ↗
Summary
A longtime bug bounty researcher criticizes HackerOne’s three-trial-report limit for researchers below program signal thresholds, arguing it may penalize veterans and newcomers while addressing surging low-quality, AI-generated submissions.
Key points
- HackerOne’s described policy gives researchers below a program’s signal requirement up to three trial reports across affected programs; using all three without qualifying outcomes can trigger a 90-day wait.
- The speaker says triaged or resolved reports restore trial reports, while some duplicates restore one; other outcomes such as spam or self-closed reports do not.
- The speaker argues that signal uses only the previous 12 months, so a researcher’s earlier track record may not count.
- The video attributes rising low-quality submissions partly to people using AI to generate reports without verifying findings, and cites high report volumes at several programs.
- The speaker says LiveOverflow was blocked from reporting to Vercel after exhausting trial reports, then had a duplicate report closed by an AI agent.
- Proposed changes include credit for impactful duplicates, longer-lasting and portable reputation, evaluating report quality, and allowing researchers to choose an anchor program.
- For researchers, the speaker recommends selective submissions, clear reproducible proof-of-concept evidence, and personally verifying AI-assisted findings.
Article Details
- Topics
- [00:50] HackerOne’s trial-report system and new limits
- [02:12] Bug bounty report volumes and program pressures
- [03:17] AI-generated submissions as a reported source of low-quality reports
- [03:52] Duplicate reports and the example involving LiveOverflow
- [06:13] Proposed changes to trial limits and researcher reputation
- [09:35] Practical advice for bug bounty submissions