Table of contents
15
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: Four platforms carry most public bug bounty work for individual hunters: HackerOne, Bugcrowd, Intigriti and YesWeHack. They differ on CVSS version, on how they choose who gets private invitations, on payout fees, and on how they treat low-quality AI-assisted reports. We checked the primary pages we could open. We could not confirm YesWeHack’s current rules.
- CVSS 4.0 is available on the big three, but each sets it differently. HackerOne offers custom 3.0, standard 3.1 and 4.0. Bugcrowd added 4.0 in April 2026. Intigriti sets it per company.
- Private invitations work on different signals. HackerOne ties eligibility to a Hacker Reputation score. Bugcrowd uses CrowdMatch, which weighs skill and recent valid work, and its current page publishes no numeric thresholds.
- Payout fees depend on the method. Intigriti says it covers its own side of wire transfers, but not your bank’s charges. Its help article warns that PayPal’s exchange rate can be expensive.
- AI-assisted reports are the new pressure. We did not find a platform that bans AI help outright. Several require validation, disclosure or review, and program-level rules vary.
- No platform is the best choice for everyone. The right one depends on your payout method, your location, and how soon you want private invitations.
The platform you pick decides which rules you work under, and those rules changed a lot in 2026.
A hunter who works on more than one platform sees this quickly. A report that is welcome on one program can be closed as “not applicable” on another, and a score that looked normal under CVSS 3.1 can look different under 4.0. This article compares the four platforms on the rules a researcher actually meets: scoring, invitations, payouts and AI.
We are not ranking them. XHack does not run a bug bounty platform. Where we could not confirm a rule, we say so.
We read each platform’s primary pages where we could open them. For HackerOne, that means its severity and reputation documentation. For Bugcrowd, its invitation documentation, its CVSS 4.0 changelog and its March 2026 policy post. For Intigriti, its payout-method help article and its CVSS 4.0 and triage blog posts. For YesWeHack, its public point-system post. Two recent news items, The Register on HackerOne’s Internet Bug Bounty and Intigriti’s May 2026 triage post, are labeled as such where we use them.
The gaps are real:
HackerOne lets a hunter choose a severity or use a calculator. Its documentation says it offers a custom CVSS 3.0 implementation, a standard CVSS 3.1 implementation and CVSS 4.0, and that customers can offer any of these or combine them. Severity becomes required from September 21, 2026, for Bug Bounty, Vulnerability Disclosure and Challenge programs that require it. Programs that have opted out still accept reports without a severity.
Reputation is the number to watch. According to HackerOne’s reputation documentation, a new profile starts at 100 and cannot go below zero. A triaged or resolved report adds 7 points. A Not Applicable closure subtracts 5, and spam subtracts 10. Informative reports have no effect. The documentation says reputation affects eligibility for private bug bounty invitations, and that a lower score also limits how many reports you can submit in a set period. It also says reputation “will never be necessary to access core functionality on the platform.”
Programs can also set a Signal requirement, a minimum Signal score a hacker must reach before submitting. HackerOne’s explanation of the feature is from a 2016 blog post. Hackers below the threshold get a limited number of trial reports through a rate limiter, and the limit rises as their results improve. Check how the current setting works on the program you target, because the 2016 post is old.
The bounty side moved too. In May 2026, The Register reported that HackerOne’s Internet Bug Bounty, which pays for open-source work, had cut its amounts. Critical went from $9,250 to $2,257, and medium from $1,843 to $297. The program is paused and is not taking new submissions. HackerOne attributed delayed payments to a “temporary operational backlog.” The Internet Bug Bounty is one program, not the whole platform. It still shows the risk: amounts can change after you file, and a payout can arrive months later at a lower figure.
We did not find HackerOne’s fee terms for hunters in the pages we read, so we do not state one.
Bugcrowd’s current invitation documentation says researchers receive private invitations only when they are selected. Its CrowdMatch algorithm scores each researcher against the engagement’s criteria, the number of available invitations and the customer’s requirements. The general criteria are demonstrated skill, recent submission activity (valid reports over the past 90 days) and all-time performance. Geographic restrictions, background checks and identity verification can also affect selection.
The page gives no numeric thresholds, and it says the standard qualifications “are subject to change.” A 2020 Bugcrowd post did list numeric thresholds, including four all-time submissions and more than 50% accuracy over 90 days. Treat those numbers as history, because the current page does not publish them.
Bugcrowd’s March 10, 2026 policy post sets two rules that matter for anyone submitting with AI help. Ten consecutive invalid reports trigger a review, and an account may be suspended for 30 days if its submissions look automated without validation. Ten invalid reports in total require identity verification before more submissions. Bugcrowd said these may not be the whole list.
Bugcrowd added CVSS 4.0 support to the platform in April 2026, according to its changelog. Once a program enables it, new submissions default to 4.0. Existing submissions are not switched automatically, and they must be reviewed or updated in bulk through the API.
Intigriti’s CVSS 4.0 blog post, dated May 28, 2025, says the setting is made at the company level, so every program in an organization uses the same method. Companies can switch whenever they are ready. The post does not say whether triagers adjust a researcher’s score, so ask the program before you assume either way.
Intigriti’s payout-method help article is the clearest set of researcher payment terms we could open. It lists these options:
Some programs require wire transfer only, and the program description says so.
Intigriti’s May 5, 2026 triage post, by its triage team, makes a point about AI-generated reports. It says these reports “look serious and seem like they might contain valuable information,” which means triagers must investigate more before they can dismiss them. It also flags AI-written replies pasted in full, including headers and the original prompt. The post says Intigriti’s Community Code of Conduct includes an AI disclosure requirement. We did not open the code of conduct to confirm that.
| HackerOne | Bugcrowd | Intigriti | YesWeHack | |
|---|---|---|---|---|
| CVSS options | Custom 3.0, standard 3.1, 4.0 | 4.0 added April 2026 | Set per company, 4.0 available | Not confirmed |
| Severity requirement | Required from Sept 21, 2026, on programs that require it | Not confirmed | Not confirmed | Not confirmed |
| How private invites work | Reputation-based eligibility | CrowdMatch: skill and 90 days of valid work | Not confirmed | 2019 post does not say; current rule not confirmed |
| Score that moves your standing | Reputation starts at 100: +7 triaged or resolved, -5 Not Applicable, -10 spam | Kudos and rank; no numeric invite threshold published | Not confirmed | Points: 5 to 50 per bounty (2019 post) |
| Researcher fee terms | Not confirmed | Not confirmed | Wire: Intigriti covers its side; PayPal: exchange rate can be costly | Not confirmed |
| AI-assisted report rules | Program-level rules; Signal requirement | March 10, 2026: ten consecutive invalid reports trigger review | Validation and AI disclosure stance (blog); triage stays human | Not confirmed |
Four things hold across the platforms we read.
Validation matters more than the tool. Bugcrowd’s rules target submissions sent without validation. Intigriti’s guidance asks researchers to understand and validate AI output before they submit it. A tool’s output is a claim, and your reproduction is the evidence.
Duplicates are rising. Intigriti’s triage post says more people can now reach the same findings. A fast report may already be filed by the time you submit.
Programs set their own AI rules. We found a secondary summary that says HackerOne’s policy templates let program managers add AI rules, such as requiring disclosure of AI tool use or banning fully autonomous submissions. We did not confirm the template text, so check the program’s policy.
Reputation punishes weak work. HackerOne’s -5 for a Not Applicable closure and -10 for spam make weak work costly. Bugcrowd’s invalid-report review works the same way. Signal requirements, where a program sets them, cap how many reports a low-Signal hacker can submit.
Choose the platform by your constraint, not by a ranking.
XHack is not a bug bounty platform. It does not triage for programs, does not guarantee a payout, and does not find bugs for you on any platform. What it does is help you check and write up a finding before you submit it. Our findings page describes findings that include proof, reproduction steps and an export to PDF, HTML, Markdown or JSON. Our release notes say the newest version requires a CVSS v4.0 rating and a CWE on each finding.
XHack AI can be wrong in either direction, so review each finding yourself before you submit it to any platform. A rating from a tool is a starting point, not a decision the platform will accept for you.
The sources do not answer that. Payouts depend on the program’s reward grid, the severity the program assigns and the budget behind the program. The Internet Bug Bounty cut shows that amounts can change after a report is filed, so treat any headline figure as a range, not a promise.
Some state a fee for specific payment methods, and some do not state one for researchers. Intigriti’s help article says it covers its own side of wire fees, and that PayPal’s exchange rate can be costly. For HackerOne, Bugcrowd and YesWeHack, we did not confirm a researcher fee from the pages we read.
HackerOne offers CVSS 4.0 alongside 3.0 and 3.1. Bugcrowd added 4.0 in April 2026, and new submissions default to it once a program enables it. Intigriti sets the version for each company. We could not confirm YesWeHack’s support.
On HackerOne, keep your reputation high, since eligibility depends on it. On Bugcrowd, keep recent valid work and skill-matched submissions, and complete your profile and identity verification. Bugcrowd’s current page publishes no numeric threshold. Platform rules change, so check each platform’s current documentation.
Repeated invalid reports can. Bugcrowd’s March 2026 rules add a review after ten consecutive invalid reports and a possible 30-day suspension for submissions that look automated without validation. Intigriti asks researchers to validate AI output and, according to its blog, to follow an AI disclosure requirement in its code of conduct. Check each program’s rules, because programs can add their own.
Four platforms, four rule sets. Pick the platform by the constraint that bites first: the invitation system you can work within, the payout method you can afford, and the CVSS version the program uses. Read the current policy page before you commit, because the rules changed in 2026 and will change again.
Categories
Related articles
