Just received an email from HackerOne:
"Starting August 14, 2026, submitting to Bug Bounty Programs (BBPs) on the H1 Platform will require a verified identity. This applies to every account, new and existing, across all bug bounty programs, whether managed or unmanaged."
Yikes.
ang_cire6 hours ago
As someone who's managed bug bounty programs, I'm fine with this?
I've had at least 2 times where a researcher did something to get themselves removed from a program, and came back with alt accounts.
I don't know what issues they run into with their backend systems when it comes to payment, but I can also imagine that it's important for tax and compliance purposes for H1 or BC to know who they are facilitating money to be transferred to? Probably don't want to find out they're a sanctioned entity using a VPN.
I'm kind of struggling to think of a job/ do-work-get-money system that doesn't require identity verification.