# hackerone

Published articles for hackerone.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## What human hackers still do better than AI, according to HackerOne's CEO

DevFeed: [What human hackers still do better than AI, according to HackerOne's CEO](<https://devfeed.tech/articles/what-human-hackers-still-do-better-than-ai-according-to-hackerone-s-ceo-113180.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/11/03/kara-sprague-hackerone-ai-bug-bounty/>)

Author: Mirko Zorz

Published: 2026-11-03T06:30:36Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Security](<https://devfeed.tech/topics/security.md>), [exploit chaining](<https://devfeed.tech/topics/exploit-chaining.md>), [human review](<https://devfeed.tech/topics/human-review.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [automation](<https://devfeed.tech/tags/automation.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [business-logic](<https://devfeed.tech/tags/business-logic.md>), [cxo](<https://devfeed.tech/tags/cxo.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [don-t-miss](<https://devfeed.tech/tags/don-t-miss.md>), [features](<https://devfeed.tech/tags/features.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [hot-stuff](<https://devfeed.tech/tags/hot-stuff.md>), [news](<https://devfeed.tech/tags/news.md>), [opinion](<https://devfeed.tech/tags/opinion.md>), [strategy](<https://devfeed.tech/tags/strategy.md>), [tips](<https://devfeed.tech/tags/tips.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Kara Sprague says AI can scale discovery of familiar bugs, while researchers retain an advantage in judging business impact, understanding intended workflows, and spotting abuse of business logic. She describes vulnerability chaining as increasingly within models' reach, but says it still depends on context supplied by people. HackerOne's cited 2026 report says 72% of researcher respondents identify business logic flaws as their fastest-growing category; Sprague cautions that this is suggestive, not proof of a lasting human advantage. Submissions have grown 2.8 times since January 2025, compared with 1.9 times for valid reports, and she cannot reliably attribute the volume or noise to AI. Programs are using track-record-based submission limits and private access tiers, and need faster review with both people and automation. Sprague expects routine medium-severity findings to earn less as they become easier to find, while novel findings requiring judgment may hold value or earn more. She also reports that about 70% of security leaders say validated findings reach backlogs faster than teams can fix them.

### Source excerpt

AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business. In this Help Net Security interview, Kara Sprague, CEO of HackerOne, talks about business logic bugs, what AI does to the crowd model, and why routine medium-severity findings may pay less. She also covers the growing pile of AI-assisted submissions, how programs sort useful reports from spam, and which parts of a researcher's work ... More -> The post What human hackers still do better than AI, according to HackerOne's CEO appeared first on Help Net Security.

## ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable

DevFeed: [ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable](<https://devfeed.tech/articles/projectdiscovery-adds-neo-triage-to-confirm-which-vulnerabilities-are-exploitable-100525.md>)

Original publisher: [Read original article](<https://siliconangle.com/2026/10/26/projectdiscovery-adds-neo-triage-to-confirm-which-vulnerabilities-are-exploitable/>)

Author: Duncan Riley

Published: 2026-10-26T14:00:17Z

Content type: news

Language: en

Sources: [SiliconANGLE](<https://devfeed.tech/sources/siliconangle.md>)

Topics: [alert triage](<https://devfeed.tech/topics/alert-triage.md>), [code security](<https://devfeed.tech/topics/code-security.md>), [ai code review](<https://devfeed.tech/topics/ai-code-review.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-assisted](<https://devfeed.tech/tags/ai-assisted.md>), [ai-code-review](<https://devfeed.tech/tags/ai-code-review.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [backlog](<https://devfeed.tech/tags/backlog.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [bug-hunting](<https://devfeed.tech/tags/bug-hunting.md>), [crv](<https://devfeed.tech/tags/crv.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [cybersecurity-company](<https://devfeed.tech/tags/cybersecurity-company.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [github](<https://devfeed.tech/tags/github.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [neo](<https://devfeed.tech/tags/neo.md>), [neo-security](<https://devfeed.tech/tags/neo-security.md>), [neo-triage](<https://devfeed.tech/tags/neo-triage.md>), [news](<https://devfeed.tech/tags/news.md>), [nuclei](<https://devfeed.tech/tags/nuclei.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [orca-security](<https://devfeed.tech/tags/orca-security.md>), [penetration-testing](<https://devfeed.tech/tags/penetration-testing.md>), [platform](<https://devfeed.tech/tags/platform.md>), [projectdiscovery](<https://devfeed.tech/tags/projectdiscovery.md>), [qualys](<https://devfeed.tech/tags/qualys.md>), [rishi-sharma](<https://devfeed.tech/tags/rishi-sharma.md>), [scanners](<https://devfeed.tech/tags/scanners.md>), [security](<https://devfeed.tech/tags/security.md>), [security-testing](<https://devfeed.tech/tags/security-testing.md>), [the-latest](<https://devfeed.tech/tags/the-latest.md>), [triage](<https://devfeed.tech/tags/triage.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [vulnerability-triage](<https://devfeed.tech/tags/vulnerability-triage.md>)

### AI overview

Neo Triage aims to reduce manual vulnerability triage by trying to reproduce each reported finding against the live asset from an isolated sandbox designed not to cause damage. It returns verdicts such as valid, duplicate, or spam, provides the test traffic as evidence, and bases severity on demonstrated impact while also considering asset exposure and reachable data or systems. Findings from sources including HackerOne, GitHub advisories, security mailboxes, Qualys, and Orca Security go to one board; other tools can connect through an API. For confirmed issues, Neo suggests fixes, drafts researcher replies, and retests after changes ship. ProjectDiscovery estimates human review of 100,000 findings at 50,000 hours versus roughly 8,300 hours reviewing Neo's verdicts; these are company estimates, not independent results. Neo Triage is included in all Neo tiers, including free.

### Source excerpt

Open-source cybersecurity company ProjectDiscovery Inc. today added Neo Triage to its Neo security testing platform to confirm which reported vulnerabilities can actually be exploited before teams start fixing them. The new capability goes after the triage backlog, which ProjectDiscovery blames on artificial intelligence. Scanners, AI code review and AI-assisted bug hunting now turn up findings [...] The post ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable appeared first on SiliconANGLE.

## Do minor curl vulnerabilities in the open

DevFeed: [Do minor curl vulnerabilities in the open](<https://devfeed.tech/articles/do-minor-curl-vulnerabilities-in-the-open-90644.md>)

Original publisher: [Read original article](<https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/>)

Author: Daniel Stenberg

Published: 2026-10-20T06:09:42Z

Content type: article

Language: en

Sources: [Daniel Stenberg](<https://devfeed.tech/sources/daniel-stenberg.md>)

Topics: [cURL](<https://devfeed.tech/topics/curl.md>), [cve remediation](<https://devfeed.tech/topics/cve-remediation.md>), [open source maintenance](<https://devfeed.tech/topics/open-source-maintenance.md>), [known exploitable vulnerabilities](<https://devfeed.tech/topics/known-exploitable-vulnerabilities.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [basic](<https://devfeed.tech/tags/basic.md>), [critical](<https://devfeed.tech/tags/critical.md>), [curl](<https://devfeed.tech/tags/curl.md>), [curl-and-libcurl](<https://devfeed.tech/tags/curl-and-libcurl.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cves](<https://devfeed.tech/tags/cves.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [github](<https://devfeed.tech/tags/github.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-disclosure](<https://devfeed.tech/tags/vulnerability-disclosure.md>), [vulnerability-reports](<https://devfeed.tech/tags/vulnerability-reports.md>)

### AI overview

The curl project will route low- and medium-severity vulnerability reports to public GitHub issues starting October 26, 2026, while keeping high- and critical-severity reports private on HackerOne. The project says the change responds to a surge in reports and pressure on maintainers, and may let more people help assess reports and scrutinize fixes before release. It acknowledges that public handling gives attackers a longer opportunity to exploit lower-severity weaknesses.

### Source excerpt

The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our GitHub repository. Only vulnerabilities deemed to be HIGH or CRITICAL will be ... Continue reading Do minor curl vulnerabilities in the open ->

## How I gained commit access to Homebrew in 30 minutes

DevFeed: [How I gained commit access to Homebrew in 30 minutes](<https://devfeed.tech/articles/how-i-gained-commit-access-to-homebrew-in-30-minutes-31927.md>)

Original publisher: [Read original article](<http://engineering.remind.com/how-I-gained-commit-access-to-homebrew/>)

Author: Remind

Published: 2018-08-07T00:00:00Z

Content type: opinion

Language: en

Sources: [Remind](<https://devfeed.tech/sources/remind.md>)

Topics: [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Homebrew](<https://devfeed.tech/topics/homebrew.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Security](<https://devfeed.tech/topics/security.md>), [personal access token](<https://devfeed.tech/topics/personal-access-token.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [cURL](<https://devfeed.tech/topics/curl.md>)

Tags: [core](<https://devfeed.tech/tags/core.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [curl](<https://devfeed.tech/tags/curl.md>), [github](<https://devfeed.tech/tags/github.md>), [github-api](<https://devfeed.tech/tags/github-api.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [homebrew](<https://devfeed.tech/tags/homebrew.md>), [incident](<https://devfeed.tech/tags/incident.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [jenkins](<https://devfeed.tech/tags/jenkins.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [malicious](<https://devfeed.tech/tags/malicious.md>), [minutes](<https://devfeed.tech/tags/minutes.md>), [npm](<https://devfeed.tech/tags/npm.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [token](<https://devfeed.tech/tags/token.md>)

### AI overview

The author gained commit access to Homebrew repositories by finding a GitHub API token exposed through environment variables on the publicly accessible Jenkins instance. An initial search for leaked credentials with gitrob found nothing; reviewing disclosed issues led to Jenkins, where the token's permissions showed push access to several repositories, including homebrew-core. The author verified access by creating a test Git blob, then reported the issue. The author says a malicious commit to the master branch could have reached users installing or updating Homebrew. Homebrew and GitHub audited the token and found no malicious use or unexpected commits. The account presents the incident as a supply-chain risk tied to exposed credentials and project infrastructure.

### Source excerpt

This issue was publicly disclosed on the Homebrew blog at https://brew.sh/2018/08/05/security-incident-disclosure/ Since the recent NPM, RubyGems, and Gentoo incidents, I've become increasingly interested, and concerned, with the potential for package managers to be used in supply chain attacks to distribute malicious software. Specifically with how the maintainers and infrastructure of these projects can be targeted as an attack vector. On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew's GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. Let's get leaky My initial strategy going in was based on credential theft; find if there were any credentials leaked by members of the Homebrew GitHub org. An OSSINT tool from Michael Henriksen called gitrob makes automating this search really easy. I ran it across the Homebrew organization, but ultimately didn't come up with anything interesting. Next, I took a look at previously disclosed issues on https://hackerone.com/Homebrew. From there, I found that Homebrew runs a Jenkins instance that's (intentionally) publicly exposed at https://jenkins.brew.sh. After some digging, I noticed something interesting; builds in the "Homebrew Bottles" project were making authenticated pushes to the BrewTestBot/homebrew-core repo: This got me thinking, "where are the credentials stored?". I noticed the "Environment Variables" link on the left, which led to an exposed GitHub API token: I tested it locally to see what scopes the token had: $ curl https://api.github.com/user/repos -u $GITHUB_API_TOKEN:x-oauth-basic | jq '.[] | {repo: .full_name, permissions: .permissions}' { "repo": "BrewTestBot/homebrew-core", "permissions": { "admin": true, "push": true, "pull": true } } { "repo": "Homebrew/brew", "permissions": { "admin": false, "push": true, "pull": true } } { "repo": "Homebrew/formulae.brew.sh", "permissions": { "admin": false, "push": true, "pull": true } } { "

## Vulnerability in OkHttp's Certificate Pinner

DevFeed: [Vulnerability in OkHttp's Certificate Pinner](<https://devfeed.tech/articles/vulnerability-in-okhttp-s-certificate-pinner-15950.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/vulnerability-in-okhttps-certificate-pinner>)

Author: Square Engineering

Published: 2016-03-11T17:11:00Z

Content type: news

Language: en

Sources: [Square Corner](<https://devfeed.tech/sources/square-corner-blog-medium.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [bug-bounty-program](<https://devfeed.tech/tags/bug-bounty-program.md>), [certificate](<https://devfeed.tech/tags/certificate.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [latest-release](<https://devfeed.tech/tags/latest-release.md>), [okhttp](<https://devfeed.tech/tags/okhttp.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [square](<https://devfeed.tech/tags/square.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

A bug in OkHttp's CertificatePinner could have been used to defeat certificate pinning. Security researcher John Kozyrakis disclosed it through Square's open source bug bounty program. OkHttp fixed the issue in version 3.2.0 and backported the fix to 2.7.5; the author recommends upgrading to the latest release. The excerpt points to the researcher's post for details about the vulnerability's origins and consequences, but does not explain them.

### Source excerpt

We fixed a bug that could have been used to defeat certificate pinning

## Open Source Security Bug Bounty

DevFeed: [Open Source Security Bug Bounty](<https://devfeed.tech/articles/open-source-security-bug-bounty-15791.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/open-source-security-bug-bounty>)

Author: Square Engineering

Published: 2015-05-11T16:08:00Z

Content type: release

Language: en

Sources: [Square Corner](<https://devfeed.tech/sources/square-corner-blog-medium.md>)

Topics: [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [bug-bounty-program](<https://devfeed.tech/tags/bug-bounty-program.md>), [bug-reports](<https://devfeed.tech/tags/bug-reports.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [hackerone](<https://devfeed.tech/tags/hackerone.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-projects](<https://devfeed.tech/tags/open-source-projects.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

Square announced a bug bounty for open source projects that include a BUG-BOUNTY.md file, with more projects to be added. Researchers should report flaws through the program's HackerOne page. Fixes are optional but appreciated; to keep potential security issues confidential, attach a patch to the HackerOne report instead of opening a pull request.

### Source excerpt

A new way to get paid for bug reports