HackenProof primary sources — 2026-05-15
Scope
Primary-source notes for a new HackenProof mechanism page focused on security-program formats, triage authority, disclosure policy, duplicate handling, and company-side access control.
Primary sources reviewed
- https://hackenproof.com/
- https://docs.hackenproof.com/
- https://docs.hackenproof.com/welcome/readme/services-we-provide.md
- https://docs.hackenproof.com/dashboard/company-dashboard/users-and-roles.md
- https://docs.hackenproof.com/bug-bounty/bug-bounty-process.md
- https://docs.hackenproof.com/crowdsourced-audit/audit-process.md
- https://docs.hackenproof.com/crowdsourced-audit/judging-triaging.md
- https://docs.hackenproof.com/good-to-know/vulnerability-disclosure.md
- https://docs.hackenproof.com/dualdefense-audit/contest-phases.md
- https://docs.hackenproof.com/dualdefense-audit/dd-bounty-distribution-rules.md
- https://github.com/hackenproof-public
- https://raw.githubusercontent.com/hackenproof/web3-bug-bounty-platform/master/README.md
Key source notes
- HackenProof’s docs split the platform into public bug bounties, private bug bounties, crowdsourced audits, live hacking events, and triage or mediation support rather than presenting one generic security-service funnel.
- Public bug bounties are described as unlimited-time and unlimited-budget programs open to everyone on the platform.
- Private bug bounties are described as anonymous programs where the client hand-picks a narrower set of proven researchers.
- Crowdsourced audits are time-limited, use predictable budgets, require code freeze during the audit, and restrict participation to qualified auditors.
- Company-side permissions are unusually explicit: Company Admin, Company Manager, Program Manager, Program Triager, and Report Viewer have materially different visibility and authority.
- In ordinary bug bounties, the client remains the final decision-maker on severity and reward, but HackenProof reserves the right to review disputed downgrades and threatens delisting for SLA abuse or unfair severity reductions.
- Contest duplicates are still reward-eligible, and researchers can request mediation if they disagree with triage.
- Disclosure is mutual by default after a report reaches Resolved status, but teams may disclose without hunter agreement in exploit-live or accepted-risk scenarios, with submitter personal data hidden.
- DualDefence adds a more opinionated sub-format: self-contained submissions, tighter comment rules during preliminary review, no public discussion before results, and a sybil-resistant duplicate-decay reward formula for accepted critical issues.
- The public GitHub footprint is relatively thin, which reinforces that the important source material here is the operator’s documentation and platform rules rather than open protocol contracts.
Why this cleared the bar
HackenProof is not just another bug-bounty listing site or generic audit brand. The reusable mechanism is the combination of admission policy, role-scoped internal permissions, platform-mediated triage discipline, duplicate-sharing rules, mediation rights, and disclosure governance across multiple security-program formats. That makes it a strong comparison point for security-marketplace infrastructure even without a standalone protocol whitepaper.