Cowrie Research

hackenproof

3 min read

HackenProof

  • Name: HackenProof
  • URL: https://hackenproof.com/
  • Category: security marketplace / bug-bounty and crowd-audit operator
  • Summary: HackenProof is the marketplace branch inside the broader Hacken security shell. The useful part is how plainly the authority surfaces are written down: who gets in, who triages, who can overrule, when findings get disclosed, and how duplicate-heavy contests split money. Useful specimen, not a category anchor.
  • What it does:
    • Runs public bug-bounty programs with open participation and sponsor-defined reward policies
    • Offers private bug-bounty programs with anonymous, hand-picked researcher sets
    • Operates time-limited crowdsourced audits with predictable budgets, code-freeze expectations, HackenProof-run review, and final audit reporting
    • Provides report validation, triage, and mediation workflows rather than leaving sponsor-versus-researcher disputes entirely off-platform
    • Uses a stricter DualDefence contest mode with constrained submission updates, duplicate-sensitive payout sharing, and tighter process rules
  • Key claims:
    • The docs describe HackenProof as a web3 bug-bounty platform spanning public and private bug bounties, crowdsourced audits, hackathons, and triage or mediation support
    • The services docs say public programs are open to everyone on the platform while private programs use anonymous hand-picked researchers, making admission policy a first-class control surface
    • The audit-process docs say crowdsourced audits are time-limited, use predictable budgets, require code freeze, and are restricted to qualified auditors, which is a cleaner gating model than open crowd-review markets
    • The users-and-roles docs make company-side authority unusually explicit through Admin, Manager, Program Manager, Program Triager, and Report Viewer roles
    • The bug-bounty and judging docs keep the client as final arbiter of severity and bounty, but also say HackenProof may review downgraded reports, mediate disputes, and delist unfair programs, which is real platform leverage rather than mere ticket routing
    • The vulnerability-disclosure and DualDefence docs show that disclosure timing and duplicate payout decay are codified as platform policy, including the critical-finding split formula 1 * (0.9^(N - 1)) / N
  • Whitepaper: No canonical HackenProof whitepaper or litepaper surfaced in this pass. The clearest primary materials were the official docs for services, role controls, bug-bounty flow, crowdsourced-audit flow, judging and mediation, disclosure, and DualDefence rules, collected in ../whitepapers/hackenproof-primary-sources-2026-05-15.md.

Sources

Internal linkages

  • Start with hacken. That is the parent operator shell around the marketplace.
  • Best upward reads for the marketplace branch: immunefi and cantina.

Control surface

  • The leverage sits in researcher admission, client-versus-platform triage rights, mediation escalation, disclosure timing, and the payout logic attached to each program format.

  • The note is useful because those rules are unusually explicit instead of hiding inside generic platform copy.

  • Read it as Hacken’s marketplace-and-mediation branch, with the broader audit, compliance, public-report, and proof-of-reserves operator boundary living in hacken, not as a standalone security company.

  • Treat HackenProof as a governance specimen, not as a category anchor.

  • Last reviewed: 2026-08-10 UTC

Graph View

Backlinks