HackerOne

Overview

The HackerOne integration connects the Praetorian Guard Platform (PGP) with your HackerOne bug bounty programs, importing vulnerability reports and program scope directly into your attack surface. Bug bounty findings from security researchers flow into PGP as risks — complete with severity ratings, CWE classifications, and remediation context — so you can manage them alongside every other vulnerability in a single pane of glass.

This integration is ideal for organizations running bug bounty programs on HackerOne who want to correlate researcher-reported vulnerabilities with their broader attack surface. Instead of managing bounty findings in isolation, PGP maps them to discovered assets, enriches them with platform context, and applies consistent prioritization across all vulnerability sources.

What the Integration Does

When connected, PGP performs a read-only import from HackerOne API:

• Vulnerability Reports as Risks: Every report in your HackerOne programs is imported as a PGP risk. Report state (new, triaged, resolved, duplicate, etc.) maps to PGP risk status (Triage, Open, Remediated, Deleted). Severity ratings (Critical, High, Medium, Low, None) are preserved, and metadata — including CVSS score, CWE classification, reporter username, and submission date — is stored as proof artifacts.
• Program Scopes as Seeds: Eligible-for-submission scope entries (URLs, domains, IP addresses, CIDR blocks, and source code repositories) are imported as PGP seeds, feeding them into the Guard discovery and scanning pipeline. This means your bug bounty scope automatically becomes part of your continuously monitored attack surface.

Data flows one direction only — from HackerOne into PGP. The integration never writes back to HackerOne, modifies reports, or changes program configuration.

Prerequisites

Before setting up the integration, you need a HackerOne API token:

1. Log in to your HackerOne account at hackerone.com
2. Navigate to Settings then API Tokens (or Organization Settings then API Tokens for organization-level access)
3. Click Create API Token
4. Note your API Identifier (username) and API Token (secret) — you will need both during setup
5. Ensure the token has access to the programs you want to import

The API token must have permissions to read programs, reports, and structured scopes for the target programs.

Setup

1. Go to Integrations, then Bug Bounty, then HackerOne in the Guard Platform
2. Enter your credentials in the setup form
3. Click Connect — PGP will validate your credentials by attempting to fetch your programs before saving

If validation fails, verify that your API token has the correct permissions and has not expired.

What Data Is Synced

Vulnerability Reports

Each HackerOne report creates a risk with:

• Risk name: Derived from the report title
• Severity: Critical, High, Medium, Low, or Informational — preserved from the HackerOne severity rating
• Proof artifacts: CVSS score, CWE classification (e.g., CWE-79), reporter username, submission date, program handle, and report ID
• Description and impact: Full vulnerability information and impact statement from the report

Status mapping: HackerOne report state maps to PGP status:

Program Scopes

Only scopes marked as eligible for submission are imported:

Unsupported asset types (e.g., Hardware) are silently skipped.

Source code scope and automatic scanning

When a HackerOne program includes SOURCE_CODE scope entries pointing to GitHub or GitLab repositories, those repositories are automatically imported as Repository seeds in Guard. No additional configuration is required.

Once seeded, the following capabilities run against each repository automatically:

• Titus — secrets scanning
• Trajan — CI/CD pipeline security
• Caligula — software composition analysis (SCA)

Imported repositories appear on the Seeds page alongside any manually added seeds, giving you a single view of all sources under analysis.

Submitting Findings to HackerOne

Guard supports submitting findings directly to HackerOne from within the platform, including saving reports as drafts and attaching supporting evidence.

Draft submissions

Use Save as Draft to stage a finding as a HackerOne Report Intent before final submission. The draft is sent to the HackerOne Report Intents endpoint using the field names required by the current HackerOne Hacker API specification. Drafts can be reviewed and finalized from within your HackerOne account.

Attachment support

Reports that include attachments — such as screenshots or proof-of-concept files — can be submitted without error. Attachments are included in the submission payload and delivered to HackerOne alongside the report body.

If a submission fails

If a submission or draft save returns an error, verify the following:

• Your API token is still valid and has not expired.
• The token has write permissions for the target program.
• The program handle referenced in the submission matches an accessible program in your HackerOne account.

API Endpoints Used

Base URL: https://api.hackerone.com

All requests use pagination with 100 items per page. The integration processes all accessible programs in a single sync.

Troubleshooting

Security and Data Handling

• Read-only access: The integration only reads data from HackerOne. It never creates, modifies, or deletes reports or program settings.
• Credential handling: Your API Identifier and Token are stored as encrypted credentials within PGP and are never exposed in logs or the UI after initial entry.
• Authentication: Credentials are transmitted using HTTP Basic Authentication over HTTPS to the HackerOne API.
• Data filtering: Risks pass through PGP standard VM filter rules, allowing you to control which severity levels or scan types are imported.