HackerOne: what its public programmes pay, measured

What happened

HackerOne lists 449 public programmes in the mirror, all open to submissions, 223 of them paying a bounty and 325 managed by HackerOne staff, with 41,328 in-scope assets between them. The median programme answers a report in 9 hours (n 410), pays a bounty 222 hours after submission (n 212) and resolves the report at 1,174.5 hours, about 49 days (n 300). Measured 11 September 2026 from the platform's own data as mirrored.

HackerOne publishes no maximum payout field in its directory data, so the ceiling ladder on this page comes from Bugcrowd and the web3 platforms, and HackerOne supplies the clock. Response efficiency runs at a median 85% across 443 programmes reporting it. The 41,328 in-scope assets split into seventeen types, led by URL (34,954), WILDCARD (2,713) and OTHER (1,371); SOURCE_CODE appears in 63 programmes, SMART_CONTRACT in five, and the AI_MODEL type in seven.