HackerOne will require government ID for every bug bounty submission
The August 14th rule covers new and existing accounts, while unpaid vulnerability disclosure programs remain open without verification.
By Ryan Merket · Published
Why it matters
HackerOne is moving identity checks from payouts and selected sensitive programs to the entry point for all paid research, prioritizing customer compliance over anonymous participation.
HackerOne, led by CEO Kara Sprague, will require every security researcher to verify a government-issued ID before submitting vulnerabilities to any paid bug bounty program on its platform beginning August 14th, 2026.
The requirement covers new and existing accounts across managed and unmanaged programs, according to a policy notice shown in a post Friday by International Cyber Digest. HackerOne's help documentation, updated July 31st, says the identity checks are required to meet "regulatory requirements."
The rule changes the access model built by founders Jobert Abma, Michiel Prins, Alex Rice and Merijn Terheggen, who started HackerOne in 2012 around a simple premise: independent hackers and large institutions could work together instead of treating vulnerability disclosure as an adversarial act. Abma and Prins were teenage hackers before building a penetration-testing consultancy. In one early sales tactic, they promised prospective customers a cake if they failed to find a vulnerability within 30 minutes, according to HackerOne's account of its founding.
Before Friday's update, HackerOne's documentation described ID verification as necessary for receiving rewards and entering certain sensitive programs. The revised language moves the check to the point of submission for every bug bounty program, regardless of whether an individual program previously demanded it.
HackerOne is preserving a narrower route for anonymous or unverified research. Vulnerability disclosure programs, which generally provide a formal channel for reporting security flaws without promising payment, will continue accepting submissions without identity verification. Researchers who lack acceptable documents, are uncomfortable sending identity data to a third party or are younger than 18 can still use those programs, but they will lose access to paid bug bounty submissions.
The verification process is handled by Veriff. HackerOne says researchers can generally use a passport, identity card, residence permit or driver's license, although document support varies by country. Veriff requires a physical document rather than a digital copy, and the process can include a selfie. HackerOne says verification must be renewed annually.
HackerOne also instructs applicants to disable VPNs and traffic anonymizers during verification. Applications completed through a jailbroken device or software emulator will be rejected, according to the help page. Researchers younger than 18 are not accepted into the identity verification program.
The notice says verification is free, a researcher's public handle will remain unchanged and identity details will not be shared with individual bug bounty programs. Veriff will still process the documents and biometric material used for the check.
For HackerOne's enterprise and government customers, mandatory identification creates a consistent record of who is probing sensitive systems. For the global researcher pool, it removes anonymity from paid participation and places document availability, age and willingness to use an identity vendor ahead of technical ability.
That trade-off carries weight because HackerOne operates at substantial scale. Its 2025 security report says its data set covered more than 580,000 validated vulnerabilities and 1,950 enterprise programs. HackerOne says it paid $81 million in bounties during 2025. Those figures are self-reported, but they show how broadly the new requirement could reach.
Sprague took over as CEO in November 2024 after running a $1.3 billion application security and delivery product operation at F5, according to HackerOne's announcement of her appointment. She inherited a platform increasingly focused on large enterprises, public-sector customers and AI security testing. HackerOne's current leadership page lists Abma as technical adviser, Prins as a senior product director and Rice as CTO and CISO.
The identity mandate fits that enterprise push by making researcher participation easier for customers to audit. It also narrows the open marketplace that helped HackerOne grow. Beginning August 14th, researchers can remain pseudonymous in public and continue filing unpaid disclosures, but earning a bounty through HackerOne will require proving who they are first.