{
  "atlas": "Earning Paths Atlas",
  "id": "hackerone",
  "name": "HackerOne (Bug Bounty)",
  "last_verified": "2026-10-19",
  "atlas_url": "https://earningpaths.dev/platforms/hackerone",
  "markdown_url": "https://earningpaths.dev/platforms/hackerone.md",
  "playbook_url": null,
  "license": {
    "id": "CC-BY-4.0",
    "name": "Creative Commons Attribution 4.0 International",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "disclaimer": {
    "de": "Keine Rechts- oder Steuerberatung. Fakten aus den verlinkten Quellen, Stand siehe geprueft_am; vor Entscheidungen Originalquelle prüfen.",
    "en": "No legal or tax advice. Facts from linked sources as of geprueft_am; verify the original source before acting."
  },
  "summary": {
    "id": "hackerone",
    "name": "HackerOne (Bug Bounty)",
    "url": "https://hackerone.com",
    "category": "bounties",
    "category_label": "Bounties",
    "summary": "Bug bounty platform: report vulnerabilities to company programs and receive rewards.",
    "ai_content": {
      "value": "bedingt",
      "rule": "AI tools explicitly allowed; the human stays accountable for every report. Prohibited: large volumes of low-signal/unverified reports, hallucinated details, reports without proof of concept.",
      "label": "Conditional"
    },
    "bot_operation": {
      "value": "bedingt",
      "api_upload": null,
      "rule": "'Hackbots' allowed but not fully autonomous: a human must investigate, validate and confirm every vulnerability before submission (hacker-in-the-loop). Automation only within each program's scope, request limits and rules.",
      "label": "Conditional"
    },
    "human_steps": {
      "count": 3,
      "minutes": 55,
      "estimated": true,
      "steps": [
        "Create account and verify identity via Veriff",
        "Complete tax form (W-8BEN for non-US persons)",
        "Validate and confirm every finding before submitting"
      ]
    },
    "kyc": {
      "value": "required",
      "details": "For any monetary reward: identity verification via Veriff (valid 12 months), a valid payment method and an approved tax form.",
      "label": "Required"
    },
    "fees": "No platform fee for hackers documented; HackerOne charges no bank fee itself, SWIFT payments may incur bank fees.",
    "payout_minimum": {
      "amount": 0,
      "currency": "USD",
      "label": "No minimum"
    },
    "payout_methods": [
      "PayPal",
      "Bank transfer (Currencycloud)",
      "BTC/USDC wallet (crypto)"
    ],
    "vat": {
      "value": "na",
      "details": "Rewards, not sales; the recipient handles taxes.",
      "label": "N/A"
    },
    "top_ban_reason": "Large volumes of low-signal or unverified AI reports",
    "last_checked": "2026-10-19",
    "source": "https://www.hackerone.com/policies/code-of-conduct",
    "sources_total": 4,
    "has_playbook": false,
    "has_documented_risks": false
  },
  "raw": {
    "ki_inhalte_erlaubt": {
      "wert": "bedingt",
      "regel": {
        "de": "KI-Werkzeuge ausdrücklich erlaubt; der Mensch bleibt für jeden Bericht verantwortlich. Verboten: viele schwache/ungeprüfte Berichte, erfundene (halluzinierte) Details, Berichte ohne Proof of Concept.",
        "en": "AI tools explicitly allowed; the human stays accountable for every report. Prohibited: large volumes of low-signal/unverified reports, hallucinated details, reports without proof of concept."
      }
    },
    "bot_bedienung": {
      "wert": "bedingt",
      "api_upload": null,
      "regel": {
        "de": "'Hackbots' erlaubt, aber nicht vollautonom: Ein Mensch muss jede Lücke prüfen und bestätigen, bevor sie eingereicht wird (hacker-in-the-loop). Automatisierung nur im Rahmen von Scope, Request-Limits und Regeln des jeweiligen Programms.",
        "en": "'Hackbots' allowed but not fully autonomous: a human must investigate, validate and confirm every vulnerability before submission (hacker-in-the-loop). Automation only within each program's scope, request limits and rules."
      }
    },
    "menschliche_schritte": [
      {
        "schritt": {
          "de": "Konto anlegen und Identität über Veriff verifizieren",
          "en": "Create account and verify identity via Veriff"
        },
        "minuten": 15,
        "minuten_geschaetzt": true
      },
      {
        "schritt": {
          "de": "Steuerformular (W-8BEN für Nicht-US-Personen) ausfüllen",
          "en": "Complete tax form (W-8BEN for non-US persons)"
        },
        "minuten": 10,
        "minuten_geschaetzt": true
      },
      {
        "schritt": {
          "de": "Jeden Fund vor dem Einreichen selbst prüfen und bestätigen",
          "en": "Validate and confirm every finding before submitting"
        },
        "minuten": 30,
        "minuten_geschaetzt": true
      }
    ],
    "kyc": {
      "erforderlich": true,
      "details": {
        "de": "Für jede Geldprämie: Identitätsprüfung via Veriff (12 Monate gültig), gültige Zahlungsmethode und genehmigtes Steuerformular.",
        "en": "For any monetary reward: identity verification via Veriff (valid 12 months), a valid payment method and an approved tax form."
      }
    },
    "gebuehren": {
      "de": "Für Hacker keine Plattformgebühr belegt; HackerOne selbst erhebt keine Bankgebühr, SWIFT-Zahlungen können Gebühren der Banken kosten.",
      "en": "No platform fee for hackers documented; HackerOne charges no bank fee itself, SWIFT payments may incur bank fees."
    },
    "mindestauszahlung": {
      "betrag": 0,
      "waehrung": "USD",
      "hinweis": {
        "de": "PayPal ohne Minimum; BTC/USDC-Wallet 15 USD; Banküberweisung 50 USD (lokal) bzw. 100 USD (SWIFT/Priority).",
        "en": "PayPal no minimum; BTC/USDC wallet 15 USD; bank transfer 50 USD (local) or 100 USD (SWIFT/priority)."
      }
    },
    "auszahlungswege": [
      "PayPal",
      "Banküberweisung (Currencycloud)",
      "BTC/USDC-Wallet (Krypto)"
    ],
    "wer_macht_ust": {
      "merchant_of_record": "nicht_zutreffend",
      "details": {
        "de": "Prämien, keine Verkäufe; Steuern trägt der Empfänger.",
        "en": "Rewards, not sales; the recipient handles taxes."
      }
    },
    "laender_einschraenkungen": {
      "de_moeglich": true,
      "abgeleitet": true,
      "details": {
        "de": "Ausgeschlossen sind Personen unter Export-/Sanktionsrecht (USA, UK, EU u. a.); Banken auf der OFAC-Liste sind nicht nutzbar.",
        "en": "Persons subject to export-control/sanctions law (US, UK, EU etc.) are excluded; banks on the OFAC list cannot be used."
      }
    },
    "bekannte_sperrgruende": [
      {
        "de": "Massenhaft schwache oder ungeprüfte KI-Berichte",
        "en": "Large volumes of low-signal or unverified AI reports"
      },
      {
        "de": "Erfundene Endpunkte/Auswirkungen (Halluzinationen)",
        "en": "Fabricated endpoints/impact (hallucinations)"
      },
      {
        "de": "Unsicheres Testen, Out-of-Scope, zu viel Traffic",
        "en": "Unsafe testing, out-of-scope activity, excessive traffic"
      },
      {
        "de": "Fremdes Bankkonto für Auszahlungen",
        "en": "Third-party bank account for payouts"
      }
    ],
    "quellen": [
      "https://www.hackerone.com/policies/code-of-conduct",
      "https://www.hackerone.com/blog/welcome-hackbots-how-ai-shaping-future-vulnerability-discovery",
      "https://docs.hackerone.com/en/articles/8395720-payment-preferences",
      "https://www.hackerone.com/terms/community"
    ],
    "geprueft_am": "2026-10-19",
    "hinweise": null,
    "id": "hackerone",
    "name": "HackerOne (Bug Bounty)",
    "kategorie": "bounties",
    "url": "https://hackerone.com",
    "kurzbeschreibung": {
      "de": "Bug-Bounty-Plattform: Sicherheitslücken in Programmen von Unternehmen melden und Prämien erhalten.",
      "en": "Bug bounty platform: report vulnerabilities to company programs and receive rewards."
    },
    "nicht_zutreffend": [],
    "notes": {}
  }
}