> To the companies: You don’t need HackerOne anymore. The tokens to build your own in-house platform cost less than single year of HackerOne.
You know, the biggest thing that HackerOne delivers is a universal payments system that requires absolutely no efforts from companies. Have you tried to manually pay hackers from around the world? It is a laborious process involving trying to find what providers are compatible and what forms of money go where. It is extremely taxing to handle this. HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency. No amount of tokens solve the accounting problem, and it is foolish to imply otherwise.
Yep, spot on - this and some level of inbound filtering are the only reason we use an external platform.
That said, with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted, and the time taken to triage has gone through the roof.
> universal payments system that requires absolutely no efforts from companies.
Indeed. I use a third party company (not HackerOne) to handle our bug bounty and the primary reason is so they handle all the payment hassles, I don't need to be involved. They also handle all the screening for false positives, which in the AI age are exploding. I also don't want to deal with that.
In general I lean towards building in-house, but this is one area I'm happy to oursource all the busywork.
This and the pre-triage are the only reasons we even use a bug bounty platform.
If paying out bounties was easy I would do it all via email; but as you said it’s almost impossible to do (unless you are maybe bigcorp and have a team just for that)
I worked at a big corp and we paid out randoms for a program (not bug bounty). It was an absolute minefield, people would lie to us about where they were located only for us to find out they’re in <insert sanctioned country here> and then legal tells us we have to pay them but we’re not allowed to at the same time.
Outsourcing all that mess is a great use of money.
Yea we also handled it ourselves the first couple years but it was so painful. Literally the same thing you described happened - as well spending weeks+ how we need to file it as tax when we pay bounty to someone in Pakistan etc.
Are you in the US? You simply collect a W8 from them that you keep on file and then the payment would be counted as an expense on taxes. We do payout to hundreds o f affiliates every year and this is how we handle it, it's really not complicated. The actual payments are done via Wise batch payments which just requires their email address.
Interesting. Do you think they are using something like Deel/Stripe to handle a lot of this ? i mean to figure out the "paying ppl around the world" complexity ... also local payment methods .. currencies .. compliance .. tax docs etc ?
It's also complying with tax and employment laws in the country the hacker is in, to the satisfaction of your legal and finance teams.
Sure, in western-style legal systems you can call them a contractor and they can pay their own tax. Just don't employ them full time for long enough to trigger 'sham contract' rules that would make them employees.
But your corporate legal team doesn't have anyone trained and licensed to give advice on Tajikistan tax and employment law, so they can't approve this proposed contract without hiring an outside legal expert. And of course all suppliers, regardless of country, must agree to our anti-slave-labour policy which permits audits of...
One might say "skip that nonsense, just send the money" - but the larger the company, the more their in-house infosec becomes a load of uptight squares who love compliance and audit. And the kind of companies that can pay out five-figure bounties tend to be pretty large.
IIRC all cryptocurrency that's money is money (so bitcoin, ethereum, etc but not necessarily project-specific tokens) and if you happen to make or lose money on a currency conversion it doesn't have tax implications.
Italy has progressive taxes on salary, with marginal rates from 23% to 43%. The latter on income above €50k
And if you've got taxes like that on earned income - shouldn't people with unearned income pay just as much? If your tax on investment gains is too small, you end up with an economy where the salaried worker renting a house pays more tax than their landlord, who owns ten houses.
I don't know. It used to be 26%, like capital gains from shares, securities, etc. but since 1st January 2026 crypto is taxed at 33% unless it's euro stablecoins (still 26%).
At this point, I think most crypto investors in Italy will just evade taxes altogether.
Buying stable coins is a mild pain because so many banks think crypto is radioactive. Then you have to wait for your deposited funds to completely settle before you can withdraw the crypto from your account and send it elsewhere. Doable, sure. Easy & convenient, not so much. I wouldn't call it a solved problem in the same way you can hand someone cash, tap to pay with your phone, or pay by scanning a QR Code.
Revolut does not have a banking license in the US. At the moment they are a front for another bank. Don't be gullible and believe blindly what the marketing departments tell you.
You got downvoted, but sadly we have 2026 and it's still not easy to send money to any bank in the world. You can say a lot of bad things about the crypto world, but thats a problem Bitcoin solved two decades ago.
In Canada, every bank has Interac e-Transfer, essentially we can easily email or text either other money. It's really wicked, and I'm always amazed other places like America don't have it built into their bank accounts and have to use 3rd-party apps to handle sending money to each other.
But anyway, the point is that it tells you every single time you send a transfer that way to be careful, because you can't undo a transfer after it's been sent. I'm assuming it's the same for most methods of bank transfer? I mean, debit transactions are surely a different beast.
Banks can always try to undo a transaction - it's just not guaranteed to work. AFAIK, credit/debit card reversals are always reversible because if the merchant doesn't have the money, it becomes their bank's problem to get the money or eat the loss. This works because the merchant is easily identifiable, well known, and has a reputation to uphold (at least to their bank). Other methods of transfer don't come with such contractual protection, but can still have best-effort.
I know Joel well and think a lot here is both accurate and well written. I led the Yahoo bug bounty program from 2023-2024 and was involved in it from about 2021. A major event that this glosses over is Covid which also happened right around this time as well. Covid killed travel (and budget) which in turn made it impossible to do the live events. A lot of companies ended up shifting to virtual live events which just never delivered on the same value, scale, or impact.
When COVID restrictions were lifted, travel and t&e budgets just never returned. Layoffs started happening and what were lavish, expensive events just couldn’t happen anymore. Hackerone charged for and likely made a lot of money on these events. I think a lot of what is talked about in the article is true but I think Covid is a big part of the why that led to it.
It is also worth remembering that the cost of travel itself, and the cost of venues itself has also increased substantially. As well as associated costs such as catering and insurance.
So in-person events have issues from both sides, those attending and those hosting.
You also do not mention corporate policies. Under pressure from investors, their employees and sometimes their home-countries, many corporates have also introduced environmental policies. So if you want the company to pay for your flight, you not only have to justify it financially, but you have to justify it environmentally too.
Sending the sales team on a paid vacation to a tropical paradise while the engineering product flounders is such a perfect representation of corporate rot it sounds like something out of a Mike Judge movie
Presidents club is a standard way to reward top performing sales reps across many industries. It doesn't indicate anything other than the company is trying to reward and retain their top sales reps. Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
That isn't true. Early sales employees ('customer success', 'technical sales', 'growth', maybe product roles) get just as much equity as engineers who join at a similar time. The difference is that engineers often join earlier, with the commensurate risk that comes with.
Also equity rarely pays out so you'd need to be comparing the probability of an exit that actually rewards the share class that engineers get, whether or not they've been diluted to nothing, whether there's a secondary market to sell on before an exit event, etc. It also depends on whether someone even wants the potential reward equity gives them over the more tangible rewards of money and perks.
Comparing this stuff is hard.
The point here though, is that the company is rewarding sales people at a time when the product is doing poorly, which implies the leadership team care more about selling a bad product than turning it into a good product. I hope that's not the case because it used to be a good platform.
Having done sales before, I can assure you that it's differently stressful rather than more stressful. Trying to sign a customer for a substantial booking is stressful, but so is deploying a complex change that you can't roll back. There's hard things about every role.
Engineers can also be axed at any time for performance. They're fortunate that most companies are bad at measuring that, but they're also subject to things like stack ranking at very bad companies (fire worst 10% every year) so it's certainly not better to be in eng rather than sales.
Ultimately all roles have aspects of them that suck, so you need to find the one that sucks least for you.
First of all it's not just SV - all of US sales is like this. Second, if you're talking about Europe - base/variable comps split may not be 50/50 but it's often the same OTE structure with some modifications due to local legalese
I am talking about software developers, not sales.
I never seen this on my 30+ years on the job, other than being an early joiner to startups, equity isn't a thing.
> Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
At very best, some companies might offer some kind of fixed bonus, if you over delivered as part of the KPI/OKR/whatever goals for the year, or the profits were nice enough that everyone gets a cut.
This one looks shocking on the outside indeed! It's however a sales HR practice: lower salary and commission, but use the alluring treat that top performers will have a special exclusive trip at the end of the year. Many are crazy for it.
It's more a reward for a competition-style work mindset.
I'm confused at the way they promoted it. Is there any way someone outside the company reading a Twitter post would consider this a positive thing for the product to be told what incentives the sales team get?
One of them, a remotely triggerable DoS vector got downgraded in severity. I got a token payment from the company, and 7 years later, it is still not marked as resolved.
Yeah I reported a j-frog vulnerability to Anthropic. It was downgraded to “informative” and they asked me to prove that I could exfiltrate data. I replied that exfiltrating data is against their program’s safe harbor policy and they just never responded. 2 months later the claude code source code leaked.
One of my only bug bounty payouts was a DoS against a site via their customer query engine. I was quite proud of it, and was relieved when they actually paid out a token amount.
It took down the entire application for all users and tenants, not just the tenant submitting the poisoned query.
I don't remember how much I was paid, a token amount for sure, but I was happy with any amount because it was a hobby and any payment was good for the CV.
Yeah, I figured that's what you meant, and most bounty programs won't pay out for stuff like that. Every application has those bugs; on a software pentest, we'd sev:lo them.
Some of them can have 1 rpi take down a full 100 node cluster, so sure sev:lo but the cyber insurance often want them fixed anyway. But it will probably take it happening before C-suite decides that 0 revenue is a problem.
Not only was there significant personal liability, but there had been multiple instances of hackers being criminally charged and sentenced to jail time for finding and reporting security vulnerabilities prior to this.
I don't think this is true, although it's a very commonly-held belief. Dan Goodin (I think?) wrote an article about this a long time ago, and was only able to come up with a few examples, and none of them fit this fact pattern.
What is true is that it is much less legally risky to test someone else's computer than it was 10-15 years ago. People forget that's what you're doing when you look for web vulns! The DOJ has had a norm over the past ~many years not to prosecute good-faith vulnerability research, even though strictly speaking it contravenes CFAA directly. But "risky on paper" is the most you could say about doing that kind of testing back in 2010.
I can think of 4-5 other situations from around that era (~2012) where people were at least charged and needed a lot of help to navigate the legal proceedings to avoid jail time.
In 2010 it was more than risky on paper.
2017-2018 is well into the established era and probably even the golden age of bug bounties when a lot of corporate and judicial thinking re: white hat cybersecurity had been shifted.
All good things don't last forever. A organization or company lasting forever with the same goal/mission while using the same methods is a statistical anomaly.
The joy/energy and human element being reduced. Or sometimes it's profit greed. Or it could just be due to economic conditions at the time. There are lots of ways for organizations to fall. Pick your poison.
Bureaucracy is a major one, as it tends to dissipate more and more resources to sustain its own infrastructure, neglecting the core mission (J. Pournelle's Law).
"You can divide our industry into two kinds of people: those who want to go work for a company to make it successful, and those who want to go work for a successful company." -- Jamie Zawinski
I am in this space. The reality is that the margins for a Bug Bounty Hunting platform are not good, triage is very expensive specially with all the AI slop that gets submitted now. You can hide it for a long time with VC money, but they need to diversify their product line to continue growing and compete against the AI pentest compagnies (which themselves will also diversify as AI pentest becomes a feature and not the whole product).
I agree. They have quality data to build an effective AI pentest product that is good enough, and they already have a good offering to bundle that into and satisfy enterprise demand.
Up and coming AI pentest companies need to have an exceptional product to get a chance to stand on their own and penetrate the enterprise market, otherwise their best scenario is an acquisition to get bundled into an established platform.
See also, the influx of spooks into various hackerspaces during the Snowden/Assange era. I truly believe there was an effort to subvert these communities, and thats what happened.
I once interviewed there, and it was the weirdest interviews of my life.
They literally asked me to prepare on the company mission and values.
The first round was about generic stuff where nothing much was asked. And ironically, despite transparency being their core mission, they didn't tell me I was rejected until I emailed them about a week later.
From the customer point of view: at a fortune500 I dealt a LOT with h1 (it was never H1) in the early days. Then we got a CISO who was mostly a showman. And at some point (which match the changes in leadership at h1 the article describes) the reports became all garbage and leadership (CISO and CTO) would talk about h1 hackathons with "top hackers flown from all over the world". Such a joke. The end result of those hackatons were 200 "internal host discovery" that were already reported internaly and teams always dismissed as "not worth fixing" and a single attack vector, usually from a brand new acquisition that was still going trhu onboarding. Pretty much never nothing relevant or actionable.
I don't understand the controversy at the heart of this post. H1 stated they don't use reports to train LLMs. Then they revealed they were using LLMs to triage reports based on previous reports. These two facts are not necessarily incompatible. It's entirely possible to use an LLM with a db tool installed to triage reports without using the body of the reports as training fodder. The article doesn't give any evidence that this was not the case. It sounds to me more like the OP already disliked H1 (for its sales practices and general enshittification) and the LLM issue was a convenient excuse to make a clean break.
> I don't understand the controversy at the heart of this post.
Did you miss this part from the article:
> They switched from talking about bug bounty programs, live hacking events, and how they could help you stay secure, to promoting their in-house AI security product and continuous security monitoring tool.
notably the in-house AI security product is trained on existing bug bounty reports.
> It sounds to me more like the OP already disliked H1 (for its sales practices and general enshittification) and the LLM issue was a convenient excuse to make a clean break.
that's pretty harsh to say when OP provided some very valid reasons, imho speaking as someone who's used HackerOne for over a decade.
And also the idea that H1 "training" models based on bug bounty reports is kind of a silly concern; frontier models have commoditized most of what was reported on H1, even at higher quality levels. H1 itself is a nonfactor.
Last time I reported a DoS bug to HackerOne, the company behind the bounty tried incite me to commit a crime against them by DoS'ing their servers using the hack I had reported in detail!
I literally showed them their server taking over a minute to respond to my request. I even showed how the delay increased proportionally to the message size... Clearly doing more processing; classic DoS vulnerability... Doesn't leave much to the imagination! But they said they would not pay me anything unless I actually proved that it scaled and caused disruption of their service!
It seemed like they were baiting me into incriminating myself for a crime that they wanted me to commit against them. It's not even the first time that I've been baited by a software company into committing a crime against themselves. I never took the bait though.
To be fair “we will compensate you if you do X” sounds a lot like a contract so you’d probably be just fine in court. (Though likely wise to avoid the chance of a legal headache)
I don't trust the legal system.
They could cover up the evidence, get me blocked on HackerOne, claim that my screenshots are AI-generated, hire top lawyers then make the judge to charge me for the lawyers' bill.
The big company always wins. The legal system is pure fiction at this point. What lawyer would stand against the big companies? Permanently destroying all their future career prospects.
Erin Brockovich?
That's a corporate propaganda movie.
Reality is more like what happened to Julian Assange or Steven Donziger. And they had support from some powerful groups. If they didn't, we wouldn't even have heard of them. That would have been my situation. Not worth the $200 bounty.
> Co-founder Michiel Prins was allowed to leave the HackerOne dungeon to perform damage control with this absolute banger of an AI slop response: [...]
Wow, it's like he prompted for the most stereotypically AI response possible. There's a tired trope in every sentence going on for four whole paragraphs! I originally quoted it too but thought better and decided to snip it out because I'm pretty sure it would get my account flagged by HN's AI detection algorithm...
Imagine doing this article as a thorough writeup to provide feedback, rewriting this for like an hour before you post it.
And then you get an AI slop response like that in return where you can't even tell whether it was just a CEO not giving a damn...or a standard dumb chat bot with a stupid response.
I'm not sure if founders are aware that these are tipping points in customer care where the people that care about your product and ecosystem will leave your company for good, and you're irreparably damaging your own reputation.
If I were OP I'd never ever touch anything with a 10ft pole that the founders will build in their lifetime, and I'd warn everyone I know in the community about it.
That's the damage they're doing with these AI optimizations to themselves.
There's a reason why everyone starts to hate your company right after your stupid chatbot was introduced.
tl;dr which begins 3,000 words in: employees were noticed to be leaving and it’s because a “fine tuning from user submissions” ai psychosis of yesteryear, except it’s amusingly happening in 2026 still. Investigation into the veracity of the claims.
From what I've seen in the bounty-related subreddits, AI is flooding bug bounty inboxes with low-value or meaningless reports, or straight-up hallucinations when people use smaller models (to turn a profit, you make lots of low-value bug reports and see who pays out).
This has a negative effect on humans doing their work with or without LLMs: curl shut down their bounty program, and GitHub just announced they're "restructuring" theirs.
The author of this post also makes a case that HackerOne hasn't been honest about LLM training and use, either to hackers or to their own staff.
Didn't Daniel later report that curl recently started getting mostly high-quality LLM reports on their bounty program? I can imagine that there would definitely be a few "bounty spammers" trying to get hits, but it seems like most of them are doing good work.
I'd say instead that the problem is that a lot of people don't care anymore about the quality of the work being done, and LLMs are accelerating it. Bounty programs have shifted from ways for people to report security bugs to ways for people to try to make money.
An LLM finds a dubious bug, an LLM turns it into a convincing report, and now the proposed solution is to have an LLM triage it? There are a lot of turtles holding up this approach and the circular logic seems hard to miss.
Automated triage can filter obvious spam, which was already fast and easy for humans to do. The hard part is independently reproducing a plausible finding and assessing its actual impact. If LLMs could already do that reliably, then the slop report problem wouldn't exist in the first place.
I tried to build it (kind of). My team is going to use it to alert us to the most critical issues so we can hop on them before waiting for triage. It's decent at figuring out criticality but it's TERRIBLE at actually doing triage and assessing whether the report is plausibly or implausibly true. Security can be really nuanced, and from my experience so far with the model I'm using it's really bad at being skeptical enough to actually figure out if something is a legit issue with impact or not. I agree though, it would be awesome if we could get AI triage that worked.
You’re surprised that workers don’t like their work being used to remove the need to pay them for it in the future? Your idea of time saved for the worker is for them to lose their livelihood without compensation
I can understand coming down on either side of the question of whether these AI reports save or waste time. I cannot understand being surprised or ignorant about the existence or high level beliefs of either side.
> To the companies: You don’t need HackerOne anymore. The tokens to build your own in-house platform cost less than single year of HackerOne.
You know, the biggest thing that HackerOne delivers is a universal payments system that requires absolutely no efforts from companies. Have you tried to manually pay hackers from around the world? It is a laborious process involving trying to find what providers are compatible and what forms of money go where. It is extremely taxing to handle this. HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency. No amount of tokens solve the accounting problem, and it is foolish to imply otherwise.
Yep, spot on - this and some level of inbound filtering are the only reason we use an external platform.
That said, with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted, and the time taken to triage has gone through the roof.
> universal payments system that requires absolutely no efforts from companies.
Indeed. I use a third party company (not HackerOne) to handle our bug bounty and the primary reason is so they handle all the payment hassles, I don't need to be involved. They also handle all the screening for false positives, which in the AI age are exploding. I also don't want to deal with that.
In general I lean towards building in-house, but this is one area I'm happy to oursource all the busywork.
This and the pre-triage are the only reasons we even use a bug bounty platform.
If paying out bounties was easy I would do it all via email; but as you said it’s almost impossible to do (unless you are maybe bigcorp and have a team just for that)
I worked at a big corp and we paid out randoms for a program (not bug bounty). It was an absolute minefield, people would lie to us about where they were located only for us to find out they’re in <insert sanctioned country here> and then legal tells us we have to pay them but we’re not allowed to at the same time.
Outsourcing all that mess is a great use of money.
Yea we also handled it ourselves the first couple years but it was so painful. Literally the same thing you described happened - as well spending weeks+ how we need to file it as tax when we pay bounty to someone in Pakistan etc.
Are you in the US? You simply collect a W8 from them that you keep on file and then the payment would be counted as an expense on taxes. We do payout to hundreds o f affiliates every year and this is how we handle it, it's really not complicated. The actual payments are done via Wise batch payments which just requires their email address.
My largest problem with H1 is how braindead scripted/AI their triage is.
- Starting scenario: no way to contact a company outside of H1 (or some other managed programme)
- The company is compromised, their customer support has no idea what this means, they have no security.txt or any other security contact
- I have explicitly told H1 to just forward it with no bounty, I don't want a bounty, only remediation, I do not care about a bounty or any reward
- H1 closes as "not eligible" and tells me to not submit stuff I can't prove it's my compromise by putting my username on it
- Corporate server is still compromised and being used as a proxy to brute force my services
Interesting. Do you think they are using something like Deel/Stripe to handle a lot of this ? i mean to figure out the "paying ppl around the world" complexity ... also local payment methods .. currencies .. compliance .. tax docs etc ?
Many solutions nowadays.
https://www.payoneer.com/ is one of them. Of course this one is a bit racist depending on which contry you were born in.
Race and country of origin are not the same
Just pay them in stable coins. That's a solved problem.
It's not just the transfer of cash.
It's also complying with tax and employment laws in the country the hacker is in, to the satisfaction of your legal and finance teams.
Sure, in western-style legal systems you can call them a contractor and they can pay their own tax. Just don't employ them full time for long enough to trigger 'sham contract' rules that would make them employees.
But your corporate legal team doesn't have anyone trained and licensed to give advice on Tajikistan tax and employment law, so they can't approve this proposed contract without hiring an outside legal expert. And of course all suppliers, regardless of country, must agree to our anti-slave-labour policy which permits audits of...
One might say "skip that nonsense, just send the money" - but the larger the company, the more their in-house infosec becomes a load of uptight squares who love compliance and audit. And the kind of companies that can pay out five-figure bounties tend to be pretty large.
Why would you or anyone in your American company care about complying with Tajikistan law?
PITA for a large company to handle stable coins etc with accounting, etc
Also PITA for people as well, we have a 33% tax on crypto selling here in Italy on profits…
stablecoins arent crypto in EU anymore, its e-money. No tax on converting to euros.
IIRC all cryptocurrency that's money is money (so bitcoin, ethereum, etc but not necessarily project-specific tokens) and if you happen to make or lose money on a currency conversion it doesn't have tax implications.
But we are talking here about assets you just receive. Not buy and resell.
You can't buy bread with stable coins
why its fucking high ??
Italy has progressive taxes on salary, with marginal rates from 23% to 43%. The latter on income above €50k
And if you've got taxes like that on earned income - shouldn't people with unearned income pay just as much? If your tax on investment gains is too small, you end up with an economy where the salaried worker renting a house pays more tax than their landlord, who owns ten houses.
Same in a lot of countries - he said profits - it’s a taxable gain like any other asset or holding.
I don't know. It used to be 26%, like capital gains from shares, securities, etc. but since 1st January 2026 crypto is taxed at 33% unless it's euro stablecoins (still 26%).
At this point, I think most crypto investors in Italy will just evade taxes altogether.
Im working on a solution to this. If you are interested pls email me at jommi(at)megaeth.com
Buying stable coins is a mild pain because so many banks think crypto is radioactive. Then you have to wait for your deposited funds to completely settle before you can withdraw the crypto from your account and send it elsewhere. Doable, sure. Easy & convenient, not so much. I wouldn't call it a solved problem in the same way you can hand someone cash, tap to pay with your phone, or pay by scanning a QR Code.
Not anymore! Most places allow this very easily now.
Exactly. Revolut is a bank that allows cryptocurrencies.
HN really is living in their own bubble.
Revolut does not have a banking license in the US. At the moment they are a front for another bank. Don't be gullible and believe blindly what the marketing departments tell you.
It works in Europe, which is one of the few advantages we have over the US.
No it doesn't. You can gamble with it, but it doesn't let you own or send it.
Skip the crypto, cut out the middle man, and just pay the hackers in cocaine directly from the board of director's supply.
Probably a similar ecological footprint to Bitcoin too...
You got downvoted, but sadly we have 2026 and it's still not easy to send money to any bank in the world. You can say a lot of bad things about the crypto world, but thats a problem Bitcoin solved two decades ago.
bitcoin is neither cheap and stable
Nor safe. Good luck recalling a wrong crpyto transaction.
If the recipient is identifiable they legally have to give the money back and you can press charges if they don't.
Can't do that with cash either, yet lots of people are using that.
it's a problem only if you can accidentally 100 000 dollars in cash, most of us can't (the amount of paper makes it tricky)
> Good luck recalling a wrong crpyto transaction.
No better than recalling a wrong bank transfer or Zelle transaction.
Wrong bank transfers can't get recalled? I know I disputed a debit card transaction and got my money back the other month
In Canada, every bank has Interac e-Transfer, essentially we can easily email or text either other money. It's really wicked, and I'm always amazed other places like America don't have it built into their bank accounts and have to use 3rd-party apps to handle sending money to each other.
But anyway, the point is that it tells you every single time you send a transfer that way to be careful, because you can't undo a transfer after it's been sent. I'm assuming it's the same for most methods of bank transfer? I mean, debit transactions are surely a different beast.
Banks can always try to undo a transaction - it's just not guaranteed to work. AFAIK, credit/debit card reversals are always reversible because if the merchant doesn't have the money, it becomes their bank's problem to get the money or eat the loss. This works because the merchant is easily identifiable, well known, and has a reputation to uphold (at least to their bank). Other methods of transfer don't come with such contractual protection, but can still have best-effort.
Literally just pay them in bitcoin. They're hackers, they'll be able to deal with it.
I know Joel well and think a lot here is both accurate and well written. I led the Yahoo bug bounty program from 2023-2024 and was involved in it from about 2021. A major event that this glosses over is Covid which also happened right around this time as well. Covid killed travel (and budget) which in turn made it impossible to do the live events. A lot of companies ended up shifting to virtual live events which just never delivered on the same value, scale, or impact.
When COVID restrictions were lifted, travel and t&e budgets just never returned. Layoffs started happening and what were lavish, expensive events just couldn’t happen anymore. Hackerone charged for and likely made a lot of money on these events. I think a lot of what is talked about in the article is true but I think Covid is a big part of the why that led to it.
> travel and t&e budgets just never returned.
It is also worth remembering that the cost of travel itself, and the cost of venues itself has also increased substantially. As well as associated costs such as catering and insurance.
So in-person events have issues from both sides, those attending and those hosting.
You also do not mention corporate policies. Under pressure from investors, their employees and sometimes their home-countries, many corporates have also introduced environmental policies. So if you want the company to pay for your flight, you not only have to justify it financially, but you have to justify it environmentally too.
Cost of everything has increased massively, but they tell us inflation is 4%.
Sending the sales team on a paid vacation to a tropical paradise while the engineering product flounders is such a perfect representation of corporate rot it sounds like something out of a Mike Judge movie
Presidents club is a standard way to reward top performing sales reps across many industries. It doesn't indicate anything other than the company is trying to reward and retain their top sales reps. Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
That isn't true. Early sales employees ('customer success', 'technical sales', 'growth', maybe product roles) get just as much equity as engineers who join at a similar time. The difference is that engineers often join earlier, with the commensurate risk that comes with.
Also equity rarely pays out so you'd need to be comparing the probability of an exit that actually rewards the share class that engineers get, whether or not they've been diluted to nothing, whether there's a secondary market to sell on before an exit event, etc. It also depends on whether someone even wants the potential reward equity gives them over the more tangible rewards of money and perks.
Comparing this stuff is hard.
The point here though, is that the company is rewarding sales people at a time when the product is doing poorly, which implies the leadership team care more about selling a bad product than turning it into a good product. I hope that's not the case because it used to be a good platform.
Technical sales and customer growth also don’t get the cut of sales that usually the actual sales reps do.
In general i think sales reps make more money overall but have a much more stressful job and can get axed whenever they underperform for a quarter etc
Having done sales before, I can assure you that it's differently stressful rather than more stressful. Trying to sign a customer for a substantial booking is stressful, but so is deploying a complex change that you can't roll back. There's hard things about every role.
Engineers can also be axed at any time for performance. They're fortunate that most companies are bad at measuring that, but they're also subject to things like stack ranking at very bad companies (fire worst 10% every year) so it's certainly not better to be in eng rather than sales.
Ultimately all roles have aspects of them that suck, so you need to find the one that sucks least for you.
That is a Silicon Valley thing, around the world you get a regular office salary and that's it.
First of all it's not just SV - all of US sales is like this. Second, if you're talking about Europe - base/variable comps split may not be 50/50 but it's often the same OTE structure with some modifications due to local legalese
I am talking about software developers, not sales.
I never seen this on my 30+ years on the job, other than being an early joiner to startups, equity isn't a thing.
> Engineers who find it distasteful should be happy to know engineers typically get way more equity than sales reps.
At very best, some companies might offer some kind of fixed bonus, if you over delivered as part of the KPI/OKR/whatever goals for the year, or the profits were nice enough that everyone gets a cut.
Agree on the equity, afaik it’s due to how eager European countries are to tax illiquid shares on exercise instead of on sale like in US.
Even without the equity part i think most engineers should be thankful for not having to hit their kpis to get full paycheck
This one looks shocking on the outside indeed! It's however a sales HR practice: lower salary and commission, but use the alluring treat that top performers will have a special exclusive trip at the end of the year. Many are crazy for it.
It's more a reward for a competition-style work mindset.
I'm confused at the way they promoted it. Is there any way someone outside the company reading a Twitter post would consider this a positive thing for the product to be told what incentives the sales team get?
It's not aimed at consumers of their product.
Someone outside the company who was thinking of joining a B2B sales team, and who likes tropical vacations, might react positively to this post.
Or a potential investor might be impressed to see the company has a mature sales pipeline and plenty of revenue to reward its top salespeople.
if i'm working for a company i sure hope they're sending their sales reps to a tropical paradise, and if they don't, i hope i don't own any equity.
I reported some exploits on hackerone.
Most got dismissed.
One of them, a remotely triggerable DoS vector got downgraded in severity. I got a token payment from the company, and 7 years later, it is still not marked as resolved.
I doubt my situation is unique.
Yeah I reported a j-frog vulnerability to Anthropic. It was downgraded to “informative” and they asked me to prove that I could exfiltrate data. I replied that exfiltrating data is against their program’s safe harbor policy and they just never responded. 2 months later the claude code source code leaked.
Hacking someone who asks you to hack them is legally safe even if not written in their default policy
One of my only bug bounty payouts was a DoS against a site via their customer query engine. I was quite proud of it, and was relieved when they actually paid out a token amount.
It took down the entire application for all users and tenants, not just the tenant submitting the poisoned query.
I don't remember how much I was paid, a token amount for sure, but I was happy with any amount because it was a hobby and any payment was good for the CV.
Most bounty programs won't pay for DoS at all.
it isn't simple request flooding, it is application level resource exhaustion
Yeah, I figured that's what you meant, and most bounty programs won't pay out for stuff like that. Every application has those bugs; on a software pentest, we'd sev:lo them.
Some of them can have 1 rpi take down a full 100 node cluster, so sure sev:lo but the cyber insurance often want them fixed anyway. But it will probably take it happening before C-suite decides that 0 revenue is a problem.
I reported a security bug, it was all processed very quickly and I got paid. I doubt my situation is unique.
I think it would be the individual companies slowing things down, not the platform.
Not only was there significant personal liability, but there had been multiple instances of hackers being criminally charged and sentenced to jail time for finding and reporting security vulnerabilities prior to this.
I don't think this is true, although it's a very commonly-held belief. Dan Goodin (I think?) wrote an article about this a long time ago, and was only able to come up with a few examples, and none of them fit this fact pattern.
https://news.ycombinator.com/item?id=16642155
What is true is that it is much less legally risky to test someone else's computer than it was 10-15 years ago. People forget that's what you're doing when you look for web vulns! The DOJ has had a norm over the past ~many years not to prosecute good-faith vulnerability research, even though strictly speaking it contravenes CFAA directly. But "risky on paper" is the most you could say about doing that kind of testing back in 2010.
https://m.slashdot.org/story/159162-- example circa 2011
I can think of 4-5 other situations from around that era (~2012) where people were at least charged and needed a lot of help to navigate the legal proceedings to avoid jail time.
In 2010 it was more than risky on paper.
2017-2018 is well into the established era and probably even the golden age of bug bounties when a lot of corporate and judicial thinking re: white hat cybersecurity had been shifted.
Maybe in the US but see eg germany: https://binsec.wiki/en/pentesting-guidelines/pt-legal-framew...
Doubt, I’d argue it’s the opposite given the term “vulnerability research” is being overloaded to include things such as F12 on a school website.
They got corpo touched?
It got the executives it paid for
All good things don't last forever. A organization or company lasting forever with the same goal/mission while using the same methods is a statistical anomaly.
What is the corrupting force?
The joy/energy and human element being reduced. Or sometimes it's profit greed. Or it could just be due to economic conditions at the time. There are lots of ways for organizations to fall. Pick your poison.
The people who cared leave and are replaced by people who just want a job.
Bureaucracy is a major one, as it tends to dissipate more and more resources to sustain its own infrastructure, neglecting the core mission (J. Pournelle's Law).
Usually money.
Often preceded by the waning of the passion and self sacrifice that enables things to happen without money.
It’s sad when it’s asymmetric - founders lose their idealism and sell out while early employees fail to notice the game has changed.
But dreams are rarely enough to keep things going. And VCs know just what to say to make it seem like the dream and the money can coexist.
Yep.
It can be power - see Reddit and Wikipedia mods - but it's usually money. And once VC fundraising is involved, it's pretty much always money.
Which is another way to say "viability".
Not always.
"You can divide our industry into two kinds of people: those who want to go work for a company to make it successful, and those who want to go work for a successful company." -- Jamie Zawinski
I am in this space. The reality is that the margins for a Bug Bounty Hunting platform are not good, triage is very expensive specially with all the AI slop that gets submitted now. You can hide it for a long time with VC money, but they need to diversify their product line to continue growing and compete against the AI pentest compagnies (which themselves will also diversify as AI pentest becomes a feature and not the whole product).
I agree. They have quality data to build an effective AI pentest product that is good enough, and they already have a good offering to bundle that into and satisfy enterprise demand.
Up and coming AI pentest companies need to have an exceptional product to get a chance to stand on their own and penetrate the enterprise market, otherwise their best scenario is an acquisition to get bundled into an established platform.
money happened. it corrupts all. once there is enough of it going around people lose all senses and just want more.
See also, the influx of spooks into various hackerspaces during the Snowden/Assange era. I truly believe there was an effort to subvert these communities, and thats what happened.
Bug bounty programs were overrun with low-effort slop nearly a decade before LLMs were introduced; I can't imagine what they're like now...
You don't want to. It's exactly as bad as you think. I would say ~90% of reports are false now as opposed to ~40% before LLMs.
I once interviewed there, and it was the weirdest interviews of my life.
They literally asked me to prepare on the company mission and values.
The first round was about generic stuff where nothing much was asked. And ironically, despite transparency being their core mission, they didn't tell me I was rejected until I emailed them about a week later.
Honestly, you could sub the other big Bug Bounty platform for H1 in this post and you’d be still extremely accurate.
From the customer point of view: at a fortune500 I dealt a LOT with h1 (it was never H1) in the early days. Then we got a CISO who was mostly a showman. And at some point (which match the changes in leadership at h1 the article describes) the reports became all garbage and leadership (CISO and CTO) would talk about h1 hackathons with "top hackers flown from all over the world". Such a joke. The end result of those hackatons were 200 "internal host discovery" that were already reported internaly and teams always dismissed as "not worth fixing" and a single attack vector, usually from a brand new acquisition that was still going trhu onboarding. Pretty much never nothing relevant or actionable.
I don't understand the controversy at the heart of this post. H1 stated they don't use reports to train LLMs. Then they revealed they were using LLMs to triage reports based on previous reports. These two facts are not necessarily incompatible. It's entirely possible to use an LLM with a db tool installed to triage reports without using the body of the reports as training fodder. The article doesn't give any evidence that this was not the case. It sounds to me more like the OP already disliked H1 (for its sales practices and general enshittification) and the LLM issue was a convenient excuse to make a clean break.
> I don't understand the controversy at the heart of this post.
Did you miss this part from the article:
> They switched from talking about bug bounty programs, live hacking events, and how they could help you stay secure, to promoting their in-house AI security product and continuous security monitoring tool.
notably the in-house AI security product is trained on existing bug bounty reports.
> It sounds to me more like the OP already disliked H1 (for its sales practices and general enshittification) and the LLM issue was a convenient excuse to make a clean break.
that's pretty harsh to say when OP provided some very valid reasons, imho speaking as someone who's used HackerOne for over a decade.
link to H1's "continuous monitoring tool" for the curious: https://www.hackerone.com/product/h1-continuous-testing
And also the idea that H1 "training" models based on bug bounty reports is kind of a silly concern; frontier models have commoditized most of what was reported on H1, even at higher quality levels. H1 itself is a nonfactor.
Last time I reported a DoS bug to HackerOne, the company behind the bounty tried incite me to commit a crime against them by DoS'ing their servers using the hack I had reported in detail!
I literally showed them their server taking over a minute to respond to my request. I even showed how the delay increased proportionally to the message size... Clearly doing more processing; classic DoS vulnerability... Doesn't leave much to the imagination! But they said they would not pay me anything unless I actually proved that it scaled and caused disruption of their service!
It seemed like they were baiting me into incriminating myself for a crime that they wanted me to commit against them. It's not even the first time that I've been baited by a software company into committing a crime against themselves. I never took the bait though.
To be fair “we will compensate you if you do X” sounds a lot like a contract so you’d probably be just fine in court. (Though likely wise to avoid the chance of a legal headache)
I don't trust the legal system. They could cover up the evidence, get me blocked on HackerOne, claim that my screenshots are AI-generated, hire top lawyers then make the judge to charge me for the lawyers' bill.
The big company always wins. The legal system is pure fiction at this point. What lawyer would stand against the big companies? Permanently destroying all their future career prospects.
Erin Brockovich? That's a corporate propaganda movie.
Reality is more like what happened to Julian Assange or Steven Donziger. And they had support from some powerful groups. If they didn't, we wouldn't even have heard of them. That would have been my situation. Not worth the $200 bounty.
The Steven Donziger story is so insane.
> Co-founder Michiel Prins was allowed to leave the HackerOne dungeon to perform damage control with this absolute banger of an AI slop response: [...]
Wow, it's like he prompted for the most stereotypically AI response possible. There's a tired trope in every sentence going on for four whole paragraphs! I originally quoted it too but thought better and decided to snip it out because I'm pretty sure it would get my account flagged by HN's AI detection algorithm...
I wonder if that's the golden handcuffed founder equivalent of blinking out SOS in morse code?
Imagine doing this article as a thorough writeup to provide feedback, rewriting this for like an hour before you post it.
And then you get an AI slop response like that in return where you can't even tell whether it was just a CEO not giving a damn...or a standard dumb chat bot with a stupid response.
I'm not sure if founders are aware that these are tipping points in customer care where the people that care about your product and ecosystem will leave your company for good, and you're irreparably damaging your own reputation.
If I were OP I'd never ever touch anything with a 10ft pole that the founders will build in their lifetime, and I'd warn everyone I know in the community about it.
That's the damage they're doing with these AI optimizations to themselves.
There's a reason why everyone starts to hate your company right after your stupid chatbot was introduced.
human slop
tl;dr which begins 3,000 words in: employees were noticed to be leaving and it’s because a “fine tuning from user submissions” ai psychosis of yesteryear, except it’s amusingly happening in 2026 still. Investigation into the veracity of the claims.
I'm surprised someone could get upset at AI triaging of bugs which would save everyone time.
From what I've seen in the bounty-related subreddits, AI is flooding bug bounty inboxes with low-value or meaningless reports, or straight-up hallucinations when people use smaller models (to turn a profit, you make lots of low-value bug reports and see who pays out).
This has a negative effect on humans doing their work with or without LLMs: curl shut down their bounty program, and GitHub just announced they're "restructuring" theirs. The author of this post also makes a case that HackerOne hasn't been honest about LLM training and use, either to hackers or to their own staff.
Didn't Daniel later report that curl recently started getting mostly high-quality LLM reports on their bounty program? I can imagine that there would definitely be a few "bounty spammers" trying to get hits, but it seems like most of them are doing good work.
I'd say instead that the problem is that a lot of people don't care anymore about the quality of the work being done, and LLMs are accelerating it. Bounty programs have shifted from ways for people to report security bugs to ways for people to try to make money.
Doesn't that problem benefit from having automatic bug triage that can avoid fast tracking these bad reports?
An LLM finds a dubious bug, an LLM turns it into a convincing report, and now the proposed solution is to have an LLM triage it? There are a lot of turtles holding up this approach and the circular logic seems hard to miss.
Automated triage can filter obvious spam, which was already fast and easy for humans to do. The hard part is independently reproducing a plausible finding and assessing its actual impact. If LLMs could already do that reliably, then the slop report problem wouldn't exist in the first place.
>If you could build the thing they wanted to build it would fix the slop problem
It sounds like a reason to try and build it than a reason to not build it.
I tried to build it (kind of). My team is going to use it to alert us to the most critical issues so we can hop on them before waiting for triage. It's decent at figuring out criticality but it's TERRIBLE at actually doing triage and assessing whether the report is plausibly or implausibly true. Security can be really nuanced, and from my experience so far with the model I'm using it's really bad at being skeptical enough to actually figure out if something is a legit issue with impact or not. I agree though, it would be awesome if we could get AI triage that worked.
You’re surprised that workers don’t like their work being used to remove the need to pay them for it in the future? Your idea of time saved for the worker is for them to lose their livelihood without compensation
I can understand coming down on either side of the question of whether these AI reports save or waste time. I cannot understand being surprised or ignorant about the existence or high level beliefs of either side.
I'm sorry you don't know the difference between training, fine tuning, and context. But definitions matter especially in legalese.