RedRouter
AI on HackerOne and Bugcrowd: a safe workflow
A HackerOne or Bugcrowd AI bug bounty workflow starts with the current program policy, not a platform logo or a model's interpretation of permission. Use AI to extract requirements and organize verified evidence. Keep authorization, active tests and submission with the researcher.
There are two different questions: using AI to research an ordinary web application, and researching an AI application's security. A program may permit one and restrict the other. Neither a general AI policy nor AI-system safe-harbor language expands the asset list by itself.
This guide uses fictional local invoice evidence. Real work must be authorized, explicitly in scope and limited to permitted methods, owned accounts and synthetic records. No submission or live test was performed for this article.
read both platform rules and program rules
Save the applicable platform guidance and the exact program policy you are operating under. Record the URL and retrieval time. Private program terms can differ from public examples, and policies can change while a hunt is in progress.
Look for four separate permissions: asset scope, active testing methods, automation and third-party processing. Then check confidentiality and disclosure timing. “AI tools allowed” does not necessarily mean “send every private request body to a hosted model,” and permission to scan doesn't authorize every template or rate.
If the text is ambiguous, use the program's designated question channel before proceeding. Don't ask a model to resolve the uncertainty in your favor. It can identify the missing clause; it cannot grant the missing permission.
translate requirements into a human-verified checklist
Use a policy ledger rather than an informal chat summary. The first two rows below quote public guidance checked November 5, 2026 (PT); the local-program rows are clearly fictional, not universal platform rules.
| Source | Checked at | Exact requirement | Applicability | Human confirmation |
|---|---|---|---|---|
| Bugcrowd March policy, linked below | Nov 5, 2026 PT | “You, the researcher, are responsible for the accuracy of the submission.” | Report quality and accountability | Confirm against current policy |
| HackerOne Quality Reports, linked below | Nov 5, 2026 PT | “Before submitting, verify that your issue hasn’t already been reported and that it falls within the program’s scope.” | Pre-submit review | Record what duplicate checks are available |
| local://invoice-policy — fictional | Local review time | “Only invoice.example.test is included.” | Local training asset | Researcher confirms |
| local://invoice-policy — fictional | Local review time | “Only owned synthetic invoices may be read.” | Data and method restriction | Researcher confirms |
| local://invoice-policy — fictional | Local review time | “External processing requires prior approval.” | Model-facing evidence | Hold until approved |
In your actual ledger, store a precise retrieval timestamp with its timezone and preserve the source bytes. Assign each policy clause an ID. If the policy changes, recheck outstanding tasks rather than silently keeping the old allowlist.
A useful extraction prompt is:
Identify scope, exclusions, automation, external-processing and disclosure requirements. Quote exact source text and assign a clause ID. Return unknown where a requirement is absent. Do not infer permission from a platform's use of AI in its own products. Make no requests and submit nothing.
what Bugcrowd says about unverified AI reports
Bugcrowd's March 10, 2026 policy addresses speculative or automated submissions without enough validation. It places responsibility for accuracy on the human researcher. The practical consequence is straightforward: review the evidence before generating a report, not after a triager rejects it.
The October 8, 2026 throttling update adds specific conditions for Managed Bug Bounty programs. It says an account with 10 submissions in a 90-day period is evaluated. With at least five judged submissions in that period, 90-day accuracy must remain above 50%; with fewer than five judged, lifetime accuracy must be above 50%. Otherwise the account enters the throttled state.
That update gives a minimum seven consecutive days of throttling and caps throttled accounts at six submissions per week. It also states that new accounts are throttled by default, with a minimum seven days and 10 submissions until they demonstrate the required quality, and describes lifetime-rate evaluation for returning accounts. Read the current platform documentation for your actual account status; don't reduce the policy to “everyone gets six reports.”
The update also changes accuracy treatment: N/A counts as a rejection, informational outcomes are excluded, and accuracy is evaluated across submissions regardless of payout thresholds. These are dated policy details, not a promise that a model-generated report will qualify or that a future update will keep the same thresholds.
what HackerOne's AI material does not establish
Responsible AI at HackerOne: 2026 Update, April 9, 2026, describes HackerOne's own architecture, human oversight and data commitments. It isn't blanket permission for researchers to send confidential program material to any external provider.
Don't import HackerOne's vendor-retention commitments into your own workflow or assume they describe RedRouter. The program's rules and your chosen provider's contract still need separate review. Similarly, the fact that an AI feature is in scope for one specific program says nothing about other programs' assets.
For report content, use HackerOne's Quality Reports guidance, February 5, 2025. It supports clear reproduction, expected versus actual behavior, impact and supporting materials. The public page doesn't establish every field in today's authenticated form, so verify the live interface when you submit.
map a fictional packet into a reviewable draft
| Content section | Fictional packet item | Gate before submission |
|---|---|---|
| Asset and scope | invoice.example.test; policy P01 | Confirm exact asset and applicable rule |
| Prerequisites | Owned A/T1 and B/T2; private invoice-A | Confirm memberships and sharing state |
| Reproduction | E01 owner baseline; E02 non-owner comparison | Replay only if permitted; retain raw evidence |
| Expected versus actual | P01 says deny; E02 shows synthetic marker | Rule and observation must both exist |
| Demonstrated impact | One synthetic cross-tenant read | No invented account takeover or user count |
| Supporting material | Redacted request/response pairs and controls | Remove secrets; preserve actor labels |
| Limitations | No writes, enumeration or anonymous access tested | Keep limitations in final prose |
This is a content mapping, not a claim that the platforms use identical field labels. A model may format it, but a person checks the evidence and performs the submission through the permitted channel. Don't build a bulk auto-submit loop around uncertain leads.
confidentiality continues after the report
Keep private-program details out of public write-ups, shared prompts and troubleshooting logs. Follow disclosure timing and attachment rules. If the platform or program requests an AI-use statement, describe the actual assistance honestly; don't invent a universal requirement or claim an unrun manual test.
RedRouter can serve a bounded analysis worker where external processing is permitted. See authorized uses, current models, agent setup and data handling. Zero data retention is opt-in, off by default and free on monthly plans; usage metadata remains.
What we still don't know: the public sources cannot settle your private program's permission, current account limits or report eligibility. Check those at the source. A model should help you ask the right question, not invent a favorable answer.