Platform interactions should at all times be respectful and communicated in a professional manner and tone with a view to being beneficial to the report validation process. Please do not 

Create unnecessary noise on reports by spamming report comments or submitting support tickets for updates 

Leave rude comments

Conduct yourself unprofessionally at Live Hacking Events or other in-person events where you are a representative of HackerOne

Threaten disclosure, in particular related to private programs

These actions decrease triage efficiency and are not beneficial to you as the Finder or the program

HackerOne does not tolerate any discrimination based on age, ethnicity, level of experience, nationality, personal appearance, race, religion, sexual or gender identity and orientation, physical appearance, political beliefs, or other protected classes.

Hate speech, profanity, or any aggressive threats in report comments, support tickets, or other communication methods (including related posts on social media and other platforms) will not be tolerated in any form. If it is confirmed that a Finder account is tied to actions which amount to a breach of our CoC, enforcement action may be taken.

Abusive behavior at Live Hacking Events or other in-person events where you are a representative of HackerOne is a violation of our CoC and will lead to a ban from participation in future Live Hacking Events, and we may take additional enforcement action on the HackerOne platform.

Finders must not perform unsafe testing without prior authorization. This includes (but is not limited to): exploiting a vulnerability beyond what is necessary to show impact (i.e. accessing excessive amounts of customer internal information, dumping a database, etc.), gaining access to and using accounts or production credentials not approved per the program's policy, altering production or database information or causing a Denial of Service, or otherwise impacting the stability of customer systems outside of posted testing policies.

Do not expose the existence of a private program on the HackerOne platform. This includes program name, scope, vulnerability information, bounty structure, account information, or any other detail that could identify the program. Such exposure to anyone who is not a HackerOne employee or a member of that program may result in enforcement actions. This includes word of mouth. Do not collaborate with other Finders without the express permission of the private program.

Disclosing vulnerability information without a clear, good faith effort to follow industry standard coordinated vulnerability disclosure practices is not acceptable. Do not disclose vulnerability information without exhausting all good faith efforts to coordinate with the organization and/or program over a reasonable period of time. Confidential information or data belonging to the program or their users should never be published without coordinating with the organization or program. This encompasses social media, blog posts, word of mouth, press, and other disclosure methods. When in doubt, communicate, communicate, communicate.

Only use approved communication channels to discuss vulnerabilities submitted to HackerOne. Unless the program has intentionally provided an alternative contact method to you in their program policy, contacting security teams “out-of-band” about reports submitted on HackerOne is a violation of this CoC. The HackerOne platform is the only approved communication channel, except where approved alternative communication channels are outlined within the program policy page or otherwise notified by the program.

Duplicate account abuse: Any case where multiple HackerOne user accounts are used to circumvent a sanction against a user account, or to create an unfair advantage on the platform.

Reputation farming: Any activity that creates an unfair gain in reputation. This includes sharing account access and submitting the work of other Hackers, as well as inappropriate requests for closure status changes for the purpose of maintaining reputation. This also encompasses cases where Finders may attempt to social engineer HackerOne staff into assisting with the launch of an illegitimate program.

Do not use intellectual property without prior authorization. This includes, but is not limited to the unauthorized use of other Finders work.

Do not attempt to, without authorization, socially engineer another party through impersonation of a HackerOne employee, another Finder, a program member, or a security team.

Finders are solely responsible for the tools that they use, which must be lawful and legally acquired. If it is brought to HackerOne’s attention that illegal or counterfeit software was used, HackerOne will be required to take appropriate action, including potential sanction under this Code of Conduct.

Do not attempt to obtain bounties, money or services by coercion. Individual cases of extortion or blackmail may be escalated based on severity and may amount to a criminal offense.

Do not attempt to circumvent a program or platform ban by creating new accounts. Doing so will result in an immediate permanent platform ban.