HackerOne Integration with DefectDojo

HackerOne Integration with DefectDojo

HackerOne is a crowdsourced security platform that runs bug bounty programs and vulnerability disclosure programs (VDPs) for organizations. External security researchers submit reports through the platform, where they are triaged, rated for severity (often with a CVSS vector), mapped to a weakness type, and tracked through states such as new, triaged, resolved, or closed. Reports can be retrieved through the HackerOne API as JSON or exported as CSV, and DefectDojo imports both.

HackerOne Integration with DefectDojo

Researcher reports from HackerOne are among the most credible findings we receive, because a person has already shown the issue is real. They used to live in a separate inbox from everything else. Bringing HackerOne reports into DefectDojo puts them on the affected Asset next to scanner and pentest results, with SLAs, owners, and Jira tickets. The program team keeps working with researchers in HackerOne, and engineering gets the work in the same queue as everything else.

Why HackerOne Matters

A public or private program extends testing to a large pool of researchers who look at your systems in ways scanners and internal teams don't.

• Reports cover issues automated tools tend to miss, such as broken access control, business logic flaws, and chained vulnerabilities.
• HackerOne triage adds a severity rating, weakness classification, and often a CVSS vector before a report reaches you.
• A VDP gives anyone who finds a problem a defined way to report it, which many standards and regulators now expect.
• Program metrics in HackerOne focus on submissions and payouts. Remediation tracking across the rest of your security findings happens elsewhere.

Advantages of This Integration

What we gained by routing HackerOne reports through DefectDojo:

• Researcher findings on the right Asset. Reports sit alongside SAST, DAST, and pentest results for the same application, so risk reporting includes them.
• Status carried over. Imports reflect HackerOne state: closed reports arrive mitigated with their closed date, and open ones arrive active.
• SLAs on validated issues. HackerOne severity ratings map to DefectDojo's scale, so a Critical from a researcher gets the same SLA clock as a Critical from any other source.
• CWE and CVSS preserved. API exports carry the weakness CWE, the CVSS vector and score, and any CVE IDs, which keeps reporting by weakness class accurate.
• Automated sync in DefectDojo Pro. The HackerOne connector pulls reports per program through the HackerOne API, with no export step.

How This Integration Works

DefectDojo imports HackerOne files with the HackerOne Cases scan type. The parser chooses its format from the file extension and content, so keep the .json or .csv extension on the file.

• Vulnerability disclosure JSON: the reports JSON returned by the HackerOne API, with a top-level data array.
• Bug bounty JSON: a JSON file with a top-level findings array.
• Bug bounty CSV: a CSV export that includes a bounty column.

1. Get the reports. Save the API response or the CSV export from your program to a file.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select HackerOne Cases, and upload the file. To automate (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=HackerOne Cases" \
  -F "file=@hackerone-reports.json" \
  -F "product_name=public-website" \
  -F "engagement_name=Bug Bounty" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "HackerOne Cases" \
  --report-path "./hackerone-reports.csv" \
  --product-name "public-website" \
  --engagement-name "Bug Bounty" \
  --auto-create-context

3. Or connect HackerOne (DefectDojo Pro). The connector uses HackerOne's customer API, which needs an organization API token created under Organization Settings, API Tokens (a personal token from user settings won't authenticate). Enter https://api.hackerone.com as the Location, plus the token identifier and token value. Read access to the program is enough. You can set a Minimum Severity to limit what is imported. Each program becomes a Record, and its reports are imported as findings with the HackerOne severity rating preserved. Connector findings deduplicate on the HackerOne report ID alone, since report IDs are unique on the platform.

Data Granularity: What Gets Imported

Use Cases

For an ongoing bug bounty: The AppSec team on DefectDojo Pro connects HackerOne so every triaged report appears on the affected Asset. Owners are assigned in DefectDojo, Jira tickets are created from there, and the program team confirms fixes with researchers in HackerOne.

For a VDP without a large team: A smaller organization exports reports monthly and imports them into an Engagement named for the period. DefectDojo SLAs make sure a disclosed High doesn't wait for the next quarterly review.

For combined reporting: With researcher reports, pentest findings, and scanner results on the same Assets, security leads can show which classes of issue only researchers are catching and adjust scanning or training to match.

For audit and disclosure records: DefectDojo keeps the submission date, severity, owner, and closure date for each report, which supports evidence requests about how externally reported issues are handled.

Operational Tips

• Map programs to Assets deliberately. One program often covers several applications, so use the structured scope in the description to move findings to the right Asset during triage.
• Prefer API JSON over CSV when you can. It carries CWE, CVSS, and the report link, while bug bounty files carry fewer fields.
• Bug bounty file imports deduplicate on title and severity only. Two different reports with the same title and severity can match each other, so review new imports for that.
• Because closed reports import as mitigated, you can import the full report history once to backfill metrics, then reimport or let the connector sync for ongoing updates.
• Restrict access to the Asset or Engagement. Report bodies include researcher reproduction details that you may not want visible to everyone.
• Set the connector's Minimum Severity if low-severity and informational reports would crowd remediation queues.