How to Earn Your First Bug Bounty on HackerOne (2026 Guide)

To earn your first HackerOne bounty, verify your ID, practice on Hacker101, then send one reproducible, in-scope report to a public bounty program. The minimum bounty a program can award is $50, and each program sets its own amounts by severity. Before any money moves you need a current ID verification, an approved tax form and a payout method: PayPal, bank transfer, or a Bitcoin or USDC wallet.

Set up your account first

HackerOne requires ID verification before you can submit to any bug bounty program. Vulnerability disclosure programs (VDPs), which do not pay bounties, stay open without it. Getting paid needs all of the steps below.

1. Create an account. A pseudonym is allowed, the password needs at least 12 characters, and two-factor authentication is worth turning on because some programs require it.
2. Open User settings > Rewards and payments > Payment setup and sign the Rules of Engagement.
3. Complete ID verification with Veriff. You must be 18 or older and hold a physical, unexpired ID that Veriff supports. Sessions run through a VPN, an emulator or a jailbroken device are rejected. Verification lasts 12 months.
4. Add a payment method. The account holder name must be your own and match your tax form.
5. Sign the tax form. The wizard asks whether you are a US person and whether you file as an individual or a business. HackerOne aims to approve it within 72 business hours, it must be renewed every three years, and the name on it cannot be changed later.

How reputation, signal and impact work

Every profile starts with 100 reputation, which can never drop below 0. Each closed report moves it:

• Signal is your average reputation per report, on a scale from -10 to 7. It is calculated once you have more than three closed reports, and duplicates, Informative and self-closed reports do not affect it.
• Impact is your average reputation per bounty, on a scale from 0 to 50.
• Programs can demand a minimum signal over the last 365 days: 1.0 (Strict), 0.0 (Standard) or -1.0 (Lenient). Below that you only get trial reports. Hackers with fewer than five resolved reports get 4 per program and 6 across the platform in each rolling 30 days.
• Private invitations go to hackers with an established reputation, a non-negative signal and zero Code of Conduct violations. Scoring 26 points in the Hacker101 CTF also makes you eligible. Invitations expire after 14 days.

Step by step to the first bounty

1. Learn the core bug classes. HackerOne's own success guide starts with the free Hacker101 videos, Burp Suite setup and the Hacker101 CTF.
2. Pick a target. The Opportunities page filters by program type, asset type and industry, and each card shows the minimum and maximum bounty plus response standards. Public bounty programs with broad scope give beginners the most room. VDPs are useful practice, but reports to Essential VDPs earn no reputation.
3. Read the policy closely. List the in-scope assets, excluded vulnerability types, known issues and the bounty table before you test anything.
4. Study Hacktivity. Disclosed reports show what each program accepted and how strong reports are written.
5. Confirm the bug. Reproduce it from a clean session, prove real security impact, and check that it is not a listed known issue.
6. Submit a quality report. Use a specific title, numbered reproduction steps, expected versus actual behavior, an impact statement and proof such as screenshots. Attach videos as files rather than links. Choose the weakness type and a CVSS severity. Reports cannot be edited after submission, so check the preview.
7. Work the triage. HackerOne's post-submission guide gives provisional timelines of about 2 to 4 business days for triage and about two weeks from submission to bounty, and notes that they vary by program. Answer Needs More Info requests fast, because a report left in that state for more than 30 days closes as Informative.

What bounties pay

• The minimum bounty a program can award is $50.
• Each program publishes a bounty table by severity (Low, Medium, High, Critical), as ranges or fixed amounts. Severity is usually scored with CVSS 3.0, 3.1 or 4.0.
• Once you have hacked on a program, the My Programs page shows its minimum and average bounty, which says more about realistic pay than the headline maximum.
• Programs can raise a bounty later but cannot remove one. On collaboration-enabled programs a bounty can be split with up to 10 collaborators.
• Since September 10, 2025, the Hacker Milestone Rewards Program has added points for valid reports to bounty programs: 3 for Low, 15 for Medium, 25 for High, 50 for Critical and 2 for each of the first five duplicates. Levels unlock badges, Burp Suite and PentesterLab licenses and swag. Points only count when the weakness field is filled in.

Payout methods and minimums

• Choose daily payouts, monthly payouts on the 27th, or a threshold between $100 and $10,000. Nothing is processed on the first or last day of a month.
• Bank transfers cover 37 currencies at the mid-market rate. Local payments carry no bank fee, while SWIFT payments can.
• Bitcoin payouts lose about 0.25% to 3.5% to fees. USDC network fees are not passed on, and USDC is sent on Ethereum (ERC-20).
• Rewards left unpaid for 9 months may be returned to the program, so never park a balance indefinitely.
• As of September 2026, HackerOne cannot pay HDFC Bank accounts in India, and banks on the US sanctions list are excluded.

Common problems and fixes

• Duplicates. Hard to avoid on popular programs, but a duplicate of a resolved report filed before disclosure still earns +2. Cut them down by reading Hacktivity first and testing recently added scope.
• N/A (-5). Usually means no demonstrated impact or a finding the policy excludes. Explain what an attacker actually gains, and never paste unverified scanner output, since HackerOne bans automated report delivery from scanners and scripts.
• Restricted from submissions. You are below a program's signal requirement or out of trial reports. Rebuild signal with valid reports to programs that have no requirement.
• ID verification rejected. Typical causes are a VPN, a photocopy, scan or digital copy, an expired document or blurry photos. If it fails twice in a row, email support@hackerone.com for a new link.
• Bounty awarded but not received. Confirm that ID verification, the tax form and a payment method are all complete, that bank transfers meet the $50 or $100 minimum, and that your PayPal account can accept the payment.
• Program not responding. Comment on the report, then choose Request mediation if nothing happens within 5 business days. Never contact staff off-platform, ask a private program for an invitation, or threaten disclosure. Any of these can end in a permanent ban.

Where else to hunt

The same skills transfer to Bugcrowd, Intigriti, YesWeHack and, for Web3 targets, Immunefi. Compare them in our best bug bounty platforms list, and see our PayPal profile for the payout method with no minimum.

Sources

• HackerOne Docs: Reputation
• HackerOne Docs: Signal and Impact
• HackerOne Docs: Signal Requirements
• HackerOne Docs: Restricted from Submissions
• HackerOne Docs: Invitations
• HackerOne Docs: Hacker101
• HackerOne Docs: Hacker Success Guide
• HackerOne Docs: Create an Account
• HackerOne Docs: ID Verification
• HackerOne Docs: Tax Forms
• HackerOne Docs: Payment Preferences
• HackerOne Docs: Payment FAQs
• HackerOne Docs: Awarding Bounties
• HackerOne Docs: Opportunity Discovery
• HackerOne Docs: Report States
• HackerOne Docs: Quality Reports
• HackerOne Docs: Post-Submission Guide
• HackerOne Docs: Hacker Milestone Rewards Program
• HackerOne Docs: Misconduct