HackerOne Ends Anonymous Era for Bug Bounty Hunters with Mandatory ID Verification
HackerOne has ended its long-standing anonymous model for paid bug bounty programs. Researchers must now complete mandatory identity verification before submitting any reports to programs offering monetary rewards.
Compulsory Verification Becomes a Hard Requirement
Starting August 1, every hacker must finish identity verification before submitting vulnerabilities to any Bug Bounty Program. Unverified accounts cannot submit reports or receive payouts. The rule applies to all paid programs without exception. Vulnerability Disclosure Program (VDP) projects that offer no financial rewards remain open to unverified researchers.
Verification Process Handled by Veriff
Users access the ID Verification section in their profile, sign the Rules of Engagement document, and are redirected to Veriff, an Estonian identity verification provider. The process requires a live camera scan of a government-issued ID such as a passport, national ID, residence permit, or driver’s license, plus a real-time selfie for facial matching. Scanned copies and digital IDs are not accepted.
Several restrictions apply: VPNs, traffic anonymization tools, jailbroken devices, SDK emulators, and Apple Private Relay are all prohibited and trigger automatic rejection. Verification usually completes within three business days, with a maximum queue time of 48 hours. The verification must be renewed every year.
H1 Clear Adds Criminal Background Checks
H1 Clear represents a stricter tier that combines standard verification with criminal background screening. It targets a select group of elite researchers working on internal enterprise programs. Even Clear-status researchers must still complete the annual standard verification renewal.
Common Rejection Reasons and Preparation Tips
Most rejections stem from technical issues rather than identity fraud: blurry text on documents, missing machine-readable zones, cropped barcodes, expired IDs, or use of photocopies. HackerOne recommends good lighting, removal of glasses and headwear, and use of Chrome or Safari browsers.
Industry-Wide Shift Toward De-Anonymization
The change aligns with regulatory demands for anti-money laundering compliance and customer due diligence on cross-border payments. Similar verification requirements already exist on Bugcrowd and European platforms such as Intigriti. The policy affects new researchers, those in privacy-sensitive regions, and anyone hoping to participate in time-sensitive bounty competitions, as unverified accounts cannot submit reports immediately upon discovering a vulnerability.
Related articles
Trusting Russian Root Certificates and Monitoring Domestic CT Logs
The article examines risks associated with installing Russian root certificates issued by the Ministry of Digital Development. It explains how these certificates, when trusted, enable potential MitM attacks through TSPU infrastructure by allowing on-the-fly issuance of fraudulent certificates for foreign domains. Yandex Browser stands out by enforcing Certificate Transparency checks for domestic certificates, unlike other browsers that disable CT validation in the presence of added roots. Three primary domestic CT logs are maintained by Yandex, VK, and the Ministry, with log lists updated annually. A Python script is provided to query these logs directly and verify SCT inclusion for any certificate. The piece also notes limitations of existing web monitors such as ct.tlscc.ru when dealing with newer log endpoints.
Why Legitimate Russian Websites Fail to Load With or Without VPN: TSPU RKN Blocking and MinTsifry Certificates Explained
Russian internet users are experiencing widespread access issues to legitimate domestic websites both when using VPNs and when connecting directly. The problems stem from TSPU devices installed by all ISPs under Roskomnadzor requirements and the transition to national MinTsifry certificates that foreign browsers do not trust. Three distinct error scenarios are documented: ERR_CONNECTION_TIMED_OUT when accessing Russian-IP sites over VPN, ERR_CERT_AUTHORITY_INVALID on major bank sites without VPN, and partial page loading failures caused by TSPU fingerprinting. Solutions for ordinary users include split-tunneling VPN clients, installing MinTsifry root certificates, or switching to Yandex Browser and Chromium-Gost. Website owners are advised to disable TLS 1.3, enable HTTP/2 support, and consider changing server IP addresses if SSH connections are also blocked. The article explicitly excludes any discussion of circumvention methods for prohibited content and focuses only on legal Russian resources as of August 2026.
Smart Homes on Pause: Why Digital Systems in New Buildings Fail After Three Years
Modern residential complexes increasingly rely on digital infrastructure, yet many smart home systems stop functioning properly within three years of commissioning. The root causes lie in decisions made during the design phase rather than after handover. Marketing-driven features often lack any sustainable operational model, leading to disappearing services once the warranty period ends. A fragmented vendor landscape, missing documentation, and absent ownership further accelerate degradation. Cybersecurity risks grow when updates and monitoring are neglected, turning buildings into easy targets. The article outlines how to build resilient systems that remain functional for 10–20 years by focusing on total cost of ownership, open standards, and clear responsibility frameworks.
Rospotrebnadzor and FAS to Extend Oversight to Websites: Automating Foreign Word Replacement Using LLM
Russian compliance experts have developed a specialized microservice called Normograph that combines multi-stage filtering, OCR, and LLM processing to help organizations meet the requirements of Federal Law 168-FZ on protecting the Russian language. The system automatically identifies prohibited foreign borrowings and Latin script on websites, cross-references them against official dictionaries approved by the Russian Academy of Sciences, and suggests context-aware Russian replacements while preserving marketing meaning and grammatical agreement. It excludes registered trademarks, brand names, and terms without Russian equivalents using dynamic white lists and Rospatent data. The solution processes pages up to 20 times faster than manual review by filtering out already-compliant words before sending only problematic fragments to the language model. An OCR module based on Yandex Cloud Vision extends checks to images and banners. The service was built with GigaChat API but remains provider-agnostic and avoids sending full pages or confidential data to foreign AI services.