HackerOne Enforces Real‑Name Verification: Government ID Required for Bug Reports Starting Aug 14

1. Event Timeline

On July 31, the intelligence account IntCyberDigest disclosed a major update in HackerOne’s documentation: every user, whether on managed or unmanaged projects, must complete real‑name verification.

The verification partner is Icelandic firm Veriff, which specializes in real‑time image processing and biometric identification. Users must submit a valid government‑issued document—passport, ID card, residence permit, or driver’s license—and in some regions also provide a live selfie.

Users connecting via VPNs, anonymity tools, SDK simulators, jail‑broken devices, or iOS private relay will be automatically rejected, as will anyone under 18, anyone submitting digital copies or copies older than one month.

Verification is not a one‑time action; the badge is valid for 12 months, with a reminder sent one month before expiry. Failure to re‑verify within the window results in badge removal and loss of project access.

2. Platform’s Dual‑Track Logic: Open VDP vs Closed BBP

While the bug bounty program (BBP) tightens its entry requirements, the vulnerability disclosure program (VDP) remains unchanged and open to the public without any identity checks.

This creates a two‑track system: unrestricted public disclosure for non‑monetized research versus tightly controlled, KYC‑driven participation for paid bug bounties. HackerOne cites “regulatory requirements” as the primary driver, noting AML and KYC obligations tied to monetary payouts.

3. Community Backlash: Minors, Gray Market, and Platform Self‑Destruction

The security research community reacted overwhelmingly negative on X (formerly Twitter). Representative comments include:

@IntCyberDigest: "So minors can’t join BBP—should they sell bugs on the gray market?"

@bscpot: "A platform making its own decline look this bad is worth studying 💀"

@0xsol1d: "The gray market will thrive because of this."

@veloi_: "Anyone want to report bugs? lol"

@NeverGiveUP8333: "If this speeds up triage I can accept, at least they won’t charge $10 per report."

@morpiggg: "Swap my ID and PII for a 50/50 bounty split 😜"

The anger centers on three themes: privacy erosion (why must a researcher hand over an ID?), exclusion of minors (pushing them toward illegal markets), and the absurdity of banning VPNs—an essential tool for many security researchers.

4. Policy Impact and Industry Trends

Short‑term pain: Researchers relying on anonymity will face verification barriers, likely causing a noticeable drop in submission volume when the policy takes effect.

Gray‑market shift: Some researchers, especially younger enthusiasts, may move to underground bug‑buying channels that do not require KYC, where operators can offer higher prices without compliance costs.

Dual‑track entrenchment: Over time the ecosystem may split into a compliant, closed “formal” market and a free, risk‑bearing “underground” market. Researchers unable to verify will be limited to VDP, which lacks strong incentives.

Growing regulatory pressure: HackerOne is not alone; as the bug‑bounty economy expands, regulators worldwide are tightening AML and KYC rules. EU initiatives such as the Digital Operational Resilience Act (DORA) and the NIS2 directive are pushing more platforms toward similar compliance mechanisms.

5. Conclusion

HackerOne’s forced real‑name policy trades regulatory compliance for reduced participation thresholds and privacy guarantees, effectively “taxing” security researchers. The move may push vulnerable researchers toward gray‑market channels and deepen the divide between compliant and underground bug‑bounty ecosystems.

For the broader security community, the policy provides a lens to observe how increasing regulation could reshape the bug‑bounty landscape, with uncertain prospects for those unable to meet KYC requirements.