The Evolution and Decline of HackerOne: A Retrospective

Date: 7 August 2026
Author: Joel Margolis, Security Engineer at Phantom

---

Introduction: The Elephant in the Room

If you've only been active in the bug bounty ecosystem for a few years (perhaps 1 to 3), the current state of affairs might seem normal. However, for those of us who are essentially "washed-up" veterans of the HackerOne Golden Era, there is a glaring issue that needs to be discussed.

My journey began in 2017 as a researcher. That boots-on-the-ground experience proved invaluable when I transitioned into management, overseeing several massive bug bounty programs across various organizations from 2018 through 2025. Having occupied both seats—the hunter and the manager—and having engaged in extensive private and public dialogues with HackerOne, I have a unique vantage point on this trajectory.

"I've seen the platform from every angle: as the one finding the bugs and the one paying for them."

---

The Foundation: Why HackerOne Existed

To understand the current state, we must look back at the original mission. In 2011, two ethical hackers—Jobert Abma and Michiel Prins—embarked on a mission to secure the web.

The Initial Mission

• Identify vulnerabilities in the top 100 tech giants.
• Successfully breach targets like Google, Apple, Microsoft, Facebook, and Twitter.
• Establish a legitimate pathway for vulnerability disclosure.

At the time, the legal landscape for security researchers was a minefield. The distinction between a "good actor" and a "criminal" was often an arbitrary line. Crossing that line didn't just mean a slap on the wrist; it meant potential jail time.

The Solution: HackerOne created a safe harbor. It was a mutual ecosystem where companies gave explicit consent and hackers received financial rewards. Suddenly, finding an IDOR that exposed sensitive user data didn't lead to a courtroom—it led to a thank-you note and a payout.

The Legal Shift

$\text{Risk} \xrightarrow{\text{HackerOne}} \text{Reward}$

---

The Golden Age & Live Hacking Events (LHEs)

Between 2017 and 2020, the company's North Star was simple: Build the best possible product for the hackers. The leadership consisted of people who lived and breathed the culture.

The Magic of LHEs

Live Hacking Events were the pinnacle of this era. These were high-stakes, exclusive gatherings where the world's elite researchers were flown to a location to attack a specific target.

• Productivity: A 3-day LHE often yielded more Critical and High severity reports than an entire year of standard hunting.
• Culture: Every event featured bespoke, high-quality silkscreen posters, custom stickers, and challenge coins.
• Networking: These events broke down the silos of the infosec community, fostering lifelong friendships and the exchange of novel techniques that were never shared publicly.

Community Expansion

Beyond LHEs, HackerOne invested heavily in the grassroots:

1. Community Spaces: Organizing CTFs, workshops, and online meetups.
2. Regional Clubs: Appointing local ambassadors to grow the researcher base globally.

The Transition of Quality

The decline wasn't overnight, but it was noticeable:

---

The "Profit Problem"

Around 2020 or 2021, the company hit a crossroads. Every venture-backed startup eventually faces the same existential question: How do we grow? How do we actually make money?

For the first decade, HackerOne operated primarily on Venture Capital (VC) funding. The financial trajectory looked something like this:

Raising \160\text{M}$ over eight years suggests a massive burn rate. If the company were organically self-sustaining, such aggressive fundraising would be unnecessary.

The Shift in Logic

The focus shifted from community value to shareholder value. This led to the erosion of the very things that made the platform special:

• The people who built the LHEs were laid off.
• Community initiatives were abandoned.
• The experience was streamlined for the corporate buyer rather than the researcher.

To illustrate the shift in priority, consider this pseudo-code of the company's internal logic:

def company_priority(year):
    if year < 2020:
        return "Maximize Hacker Satisfaction"
    else:
        return "Maximize Revenue for VCs"

# Current State
print(company_priority(2026)) # Output: Maximize Revenue for VCs

The result is a platform that still functions, but has lost its soul. The "safe space" remains, but the community that once defined it has largely evaporated.