---
title: "HackerOne"
description: "3 posts about HackerOne, summarised, each linking to the original."
---

# HackerOne
> 3 posts about HackerOne, summarised, each linking to the original.

## Articles

### [A Decade of Defense: Celebrating Grab's 10th Year Bug Bounty Program](https://yomu.fyi/post/a-decade-of-defense-celebrating-grab-s-10th-year-bug-bounty-program.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Pei Shan Yap
- Published: Dec 1, 2025
- Type: Announcement

Grab marks the tenth anniversary of its bug bounty program, launched with HackerOne and initially involving 23 researchers. Over the decade, it grew into a global community, partnering with more than 850 active HackerOne researchers to help protect over 187 million users across Southeast Asia. The program broadened its scope in 2023–2024, adding assets that included Indonesian financial services and AI systems, while introducing a mobile-specific bounty table and experimenting with campaigns and reward methods. Grab says it now ranks among HackerOne’s top 20 programs worldwide and top three in Asia, and credits live hacking events and regional club campaigns with expanding testing coverage and researcher relationships. Anniversary activities included invite-only campaigns in Germany, Morocco, and India, plus a broader campaign that received 461 submissions, with xchopath receiving the Best Hacker Bonus.


### [Bug Bounty Year in Review 2018](https://yomu.fyi/post/bug-bounty-year-in-review-2018.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: peter yaworski
- Published: Dec 20, 2018
- Type: Benchmark

Shopify’s 2018 bug bounty review reports its fifth year and most successful program to date, with faster handling and higher payouts. The security team cut average triage time from four days in 2017 to 10 hours in 2018 by assigning one of its 14 Application Security members to HackerOne triage each week. At Montreal’s H1-514 event, over 40 hackers produced more than 50 valid reports, supported by early submissions, disclosed resolved reports, incentive bonuses, expanded scope, and infrastructure shell access. Excluding event statistics, average bounty rose to $1,790, total payouts reached $155,750, 60% of resolved reports received a bounty, and triage, bounty, and resolution times improved, although resolved reports and participating hackers declined and some low-severity reports exceeded the one-month target.


### [2017 Bug Bounty Year in Review](https://yomu.fyi/post/2017-bug-bounty-year-in-review.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: peter yaworski
- Published: Feb 22, 2018
- Type: Announcement

Shopify’s 2017 bug bounty review reports higher payouts, four-hour average first responses, four-day triage, and changes intended to improve researcher participation. The program paid $67,550 outside the H1-415 event, with an average bounty of almost $1,100, while 121 reports were resolved and 63.1% of submissions were closed as not applicable. At H1-415, five hackers helped resolve 15 bugs for $42,000, and the program’s largest individual payout, $20,000, addressed unauthorized collaborator access caused by account-conversion logic. Shopify also acknowledges fewer resolved reports and delayed low-severity cases, then announces a $500 minimum payment at triage, clearer scope and payout guidance, a $25,000 typical maximum, and earlier access to beta functionality for eligible whitehat partner accounts.