HackerOne vs Bugcrowd pays the researcher behind a valid bounty report
H1 Bounty can be a program your team runs or a program HackerOne runs. Managed Bug Bounty puts a Bugcrowd engineer on the new submission before you pay.
A bounty report earns its keep only after someone calls it valid and someone pays the researcher. On 29 May 2026 the HackerOne offerings page listed two H1 Bounty setups. A managed program is one HackerOne designs, manages, and supports. A hosted program is one your team runs.
Bugcrowd’s bounty page is Managed Bug Bounty. The add-a-program doc has you name targets, set a reward range, and describe the skills you want. Submit, and that doc says Bugcrowd contacts you to review and launch. The getting-started guide then puts a Bugcrowd application security engineer on a submission in the New state before your team accepts it.
HackerOne H1 Bounty is the HackerOne column. H1 Response, H1 Pentest, and H1 Code are separate HackerOne products. Bugcrowd Managed Bug Bounty is the Bugcrowd column. A Bugcrowd disclosure program and a Bugcrowd pen test are separate products too.
The order is who may submit, who triages, and how the payout leaves a balance you fund. Both products can do that job. The split is which operating model the current pages name.
Overview
| Primary use case | A program that pays researchers for valid vulnerabilities. The offerings page calls it H1 Bounty | A program that pays researchers for valid vulnerabilities. The product page calls it Managed Bug Bounty |
|---|---|---|
| Program type | Managed, which HackerOne runs, or hosted, which your team runs. Programs can be private, invite-only, or public. Spot checks and campaigns sit inside H1 Bounty. H1 Challenge is the separate time-bound test | The named product is managed. The launch doc collects a private launch timeline and a later public launch timeline, then says Bugcrowd reviews the program before it goes live |
| Researcher access | Private programs are invitation-only, and the 17 July 2024 help page says programs begin private. The bounty page says you can limit participation by skill or location and can require ID verification or a background check | The launch doc asks for skills, activities, environments, and languages so Bugcrowd can select researchers. The bounty page names CrowdMatch for that selection. Public comes after the private launch you schedule |
| Triage | The bounty page describes in-house analysts who validate reports. The offerings page lists Hai Triage Services as a paid offering you can purchase with a bounty program or a disclosure program | The bounty page describes managed triage. The getting-started guide says an application security engineer checks that a New submission is valid, in scope, and not a duplicate, then moves it to Triaged |
| Day-to-day workflow | Reports land in the program inbox. You set an award on the report. A bounty table, when you publish one, suggests the amount from asset and severity | You work in Crowdcontrol, the name the docs use for the platform. Submissions in Triaged are waiting for your team. Moving one to Unresolved opens the reward prompt |
| Payout handling | Billing, dated 16 Sep 2025, offers a card or a prepayment balance. Prepayment is used first. The awarding page says payment to the researcher typically takes 2 to 7 days | Pay debits the reward pool. The rewarding doc says payments are processed every business day. A later bonus is a second reward on the same submission. A reward can be cancelled within 8 hours by default |
| Integrations | The bounty page says findings can move through 30+ bidirectional integrations. The Jira and GitHub help pages describe sync of comments, state changes, and rewards | The integrations page lists Jira and GitHub under ticketing, plus Slack and Teams. Jira can open a ticket when a submission reaches Triaged or Unresolved, and can resolve the submission when the ticket closes |
| License/pricing | No bounty-only price was printed on the H1 Bounty page on 3 Oct 2026. Reward amounts are the awards you set. Dollars that lack a full commercial line are left out of Editions | No bounty price was printed on the Managed Bug Bounty page or the pricing page on 3 Oct 2026. The pricing page is a quote form. Reward amounts are what you pay from the pool |
| Main buying consideration | Do you need the hosted option, with your team running the program, or the managed option? | Do you want the managed path, with a Bugcrowd engineer on the New submission before you accept and pay? |
The tables use the H1 Bounty page, the 29 May 2026 offerings page, the billing, awarding, bounty-table, Jira, and GitHub help pages, plus the Bugcrowd bounty page, pricing page, launch doc, getting-started guide, status and rewarding docs, and the Jira, GitHub, and integrations docs, opened 3 Oct 2026. Nobody filed a report or opened a console.
HackerOne H1 Bounty
Bugcrowd Managed Bug Bounty
HackerOne’s company page tells HackerOne’s own story and does not describe a sale of HackerOne, so this comparison treats HackerOne as independent. On 4 Nov 2025 Bugcrowd’s press release announced the acquisition of Mayhem Security, and the Bugcrowd blog that day says Bugcrowd has acquired Mayhem. Neither page prints a second closing date. Mayhem is the fuzzing product and stays outside this column. The bounty brand on the product page is still Bugcrowd.
Editions and pricing
A dollar appears below only when the page states currency, what you are buying, the billing period, the commitment, and the product. On 3 Oct 2026 the H1 Bounty page, the Managed Bug Bounty page, and the Bugcrowd pricing page did not print a bounty-program price that meets that test. Reward minimums on the awarding and launch docs are bare amounts with no month, year, or one-time label, so those amounts are not printed. A marketplace contract that bundles the bounty with disclosure, pentest, and code products is not used as the price of either column.
| How you buy it now | A HackerOne agreement for H1 Bounty, managed or hosted. The billing page says to contact sales to set the billing contact for prepayment | A Bugcrowd agreement for Managed Bug Bounty. The pricing page is a quote form. The launch doc says Bugcrowd contacts you after you submit the program |
|---|---|---|
| Public price (3 Oct 2026) | No bounty-only price on the H1 Bounty page. Do not copy a platform bundle that also names other products into this order | No bounty price on the product page or the pricing page. Disclosure-plan amounts on a different page are a different product |
| Reward money | You set the award. With a bounty table, the calculator uses asset and severity. An 8 Apr 2026 beta, for selected programs, unifies scope and rewards. Awards stack. The awarding page says an award cannot be removed once it is set. The balance or the card funds it | The launch doc fills low and high amounts from a Basic, Intermediate, or Advanced range, and you can set a higher advertised maximum. The rewarding doc suggests an amount from priority and the Vulnerability Rating Taxonomy. You can pay that suggestion or type another amount. The pool is debited when you pay |
| Outside that product | H1 Response, H1 Pentest, H1 Code, H1 Challenge, and H1 AI Red Teaming are other products. Hai Triage is a paid add-on on a bounty or a disclosure program, not a second bounty | Disclosure and pen test are other products |
| Main buying consideration | Separate the platform agreement from the reward balance. The public pages do not give a bounty price to paste into the order | Separate the managed-program agreement from the reward pool. The public pages do not give a bounty price to paste into the order |
What happens to a report
Shared steps are intake, a validity check, your acceptance, a payout, and a fix. HackerOne’s awarding page says some teams pay once the report is confirmed and others wait until it is resolved. Bugcrowd’s rewarding doc recommends paying when you move a submission from Triaged to Unresolved, which is the accepted state that still needs a fix. Resolved, on that status page, means the fix is done.
| First stop | The report is in the H1 Bounty inbox. On a managed program, HackerOne is in that loop. On a hosted program, your team runs it. Hai Triage, if you buy it, is the analyst offering named beside the bounty | The submission is New. The getting-started guide says customers usually do not review New. The engineer triages it, or places a blocker when more information is required |
|---|---|---|
| Your acceptance | You decide the report is worth an award. Set award is the control on the report. Suggest amount is the internal note when the team has not agreed | Triaged means the engineer has confirmed it and it is ready for you. You move it to Unresolved when you accept it and intend to fix it. Informational is reproducible and will not be fixed |
| Payout moment | The award can go out at confirmation or at resolution. A second award adds to the first. Prepayment is spent before the card | The reward prompt appears as you move to Unresolved. Pay debits the pool. Another reward can be added later. Cancel is available for 8 hours by default, and longer if the researcher has not claimed it and nothing has been sent |
| Issue tracker | Jira can take comments, state, rewards, assignee changes, and disclosure, and can resolve the report when the issue hits a status you select. GitHub is described as a two-way workflow with the same class of events | Jira can create the ticket at Triaged or Unresolved and can move the submission to Resolved when the ticket closes. GitHub is Push to GitHub: the submission fills a new issue, and you save the issue id back in Crowdcontrol |
| Main buying consideration | If the program is hosted, who on your team confirms the report and sets the award? | If the engineer marks it Triaged, who on your team accepts it? The getting-started guide names both a five-day ask and a one-week expected timeline |
The comment names managed programs on both HackerOne and Bugcrowd as the filter in front of your team. It matches the managed rows above. It is one comment, not a count of valid reports, and it does not choose a hosted program.
Where they overlap
Either product can pay a researcher for a valid, in-scope report, start private, and later open to a wider crowd. Both describe managed triage, a reward balance you fund, and a path into Jira and GitHub. Overlap means the same report can be sent to both programs. Two programs mean two answers and two possible payouts. Name one payer for that report.
When to use both
Run both only with a written owner for each asset group. One group can sit on a hosted H1 Bounty while another sits on Managed Bug Bounty. A short move from one program to the other is the other case. End that window by leaving each report on one program. Pointing both programs at one report repeats the overlap case above.
Choose HackerOne H1 Bounty when the order needs the hosted program your team runs or the managed program HackerOne runs, with awards coming off prepayment or a card. Choose Bugcrowd Managed Bug Bounty when a Bugcrowd engineer should move the new submission to Triaged before your team accepts it and the reward pool pays. Leave H1 Response, H1 Pentest, H1 Code, H1 Challenge, a Bugcrowd disclosure program, a Bugcrowd pen test, and Mayhem on their own orders.
FAQs
Which HackerOne product is this?
H1 Bounty, the program that pays researchers for valid reports. It can be managed or hosted. H1 Response, H1 Pentest, H1 Code, H1 Challenge, and H1 AI Red Teaming are other products. Hai Triage is a paid add-on on a bounty or a disclosure program.
Which Bugcrowd product is the column?
Managed Bug Bounty. The launch doc has Bugcrowd review the program before it goes live, and the getting-started guide puts an application security engineer on a New submission. Disclosure and pen test are other products. Mayhem is outside this column. Ownership is the paragraph under the screenshots.
Who triages the report?
On a managed H1 Bounty, HackerOne is in the loop, and Hai Triage is the paid analyst offering you can add. On a hosted H1 Bounty, your team runs the program. On Managed Bug Bounty, a Bugcrowd engineer moves a valid submission to Triaged, and your team accepts it.
When does the researcher get paid?
HackerOne’s awarding page lets you pay when the report is confirmed or when it is resolved. The typical remit on the billing page is 2 to 7 days, from prepayment first and then the card. Bugcrowd recommends paying as you move from Triaged to Unresolved. Payments run every business day, and the reward pool is debited.
What should the order say about price?
Editions is the pricing section, and it does not print a bounty dollar. The product pages did not show a bounty-program price with currency, unit, period, commitment, and product. Put the platform agreement and the reward balance or reward pool in the order as separate lines. Do not paste a bundle that also sells disclosure, pentest, or code review into the bounty line.
Is this a hands-on bake-off?
No. The comparison uses the HackerOne and Bugcrowd pages and docs opened 3 Oct 2026, plus one Hacker News comment from 3 Dec 2025. Nobody filed a report or opened a console.
