HackenProof Providers: How Hacker Teams Work as One Company

A Provider is a HackenProof account for a team of ethical hackers that works as one company. Members submit vulnerability reports under the team's name. Rewards and reputation go to the team, and the team's admins manage payouts. Here is how Providers work, from setup and roles to reports, payouts, and accountability.

What Is a Provider on HackenProof?

On most bug bounty platforms, every researcher works alone. They submit reports under their own name, collect their own bounties, and build their own reputation. That works for independent hunters. It doesn't fit security firms and research collectives, where a group of specialists works together and bills as one entity.

A Provider gives those teams a shared home on HackenProof. It is a hacker company: a group of researchers with its own profile, reports page, balance, and admins. Earlier versions of this feature were called "hackers' company". The current version has been redesigned and reworked, and it supports offers in RFPs as well as bug bounty reports.

A Provider is not the same as a regular company account. Companies on HackenProof run programs and receive reports. Providers sit on the other side: they find vulnerabilities and submit reports to those programs.

How a Provider Is Set Up

Providers aren't self-serve. A team can't turn itself into a Provider by signing up: registering as a company doesn't unlock Provider features, and members still log in as regular hackers. A Provider is created through HackenProof's new-company flow, with the Provider checkbox ticked.

The setup form is short:

• Required: company name and email.
• Optional: a logo and a description.
• Provider checkbox: marks the account as a Provider rather than a regular company.

Once the Provider is created, the user who created it becomes its first admin. From there, admins build the team by inviting two kinds of members:

• Admins, who manage the Provider, its members, and its money.
• Hackers, who find vulnerabilities and submit reports on the Provider's behalf.

An invited researcher can create a new HackenProof profile from the invite or accept it with an existing hacker account. As a rule, a hacker can be a member of only one Provider.

Roles And Permissions: Admins vs. Hackers

Both roles can submit reports. Admins also control the Provider's profile, its team, and its payouts.

Admins can also create offers for RFPs. This permission model mirrors the one regular company accounts on HackenProof already use.

Submitting Reports as a Team

A Provider member keeps their personal hacker profile. Which profile they are working from decides who gets credit for a report.

Editing, deleting and commenting

A submitted report is shared work, and the rules reflect that:

• Editing: any Provider member, admin, or hacker can edit a submitted report during the first five minutes after submission.
• Deleting: the report's author and Provider admins can delete a report. Other hackers can delete only their own reports.
• Comments: members can comment on Provider reports, and a comment can be edited or deleted within 15 minutes of posting. Any Provider member can edit or delete any comment in that window, not just their own.

How Providers Get Paid

When a program rewards a Provider's report, the money goes to the Provider's balance, not to the hacker who found the bug. Here is the path from bounty to withdrawal:

1. The program awards a bounty. The program owner rewards the report the Provider submitted. Platform-wide payout rules still apply: if a program requires KYC before payouts, that requirement holds for Provider rewards too.
2. The reward appears in Expected rewards. Until HackenProof approves the payout, it shows as expected rather than available.
3. Approval moves it to Current rewards. After approval, the amount moves to Current rewards and becomes available to withdraw.
4. An admin withdraws the funds. Only Provider admins can add wallets and withdraw money.

Two safeguards protect withdrawals:

• Two-factor authentication is mandatory. An admin without 2FA enabled can't add a new wallet or withdraw funds.
• There is a minimum balance. The Provider's balance must be at least $100 before funds can be withdrawn.

Every withdrawal is logged with the withdrawal date, currency, bounty amount, state, and the admin who made it. Recording the admin matters when a Provider has several of them: if five admins can all withdraw, the team needs to know who moved which funds. The log works like a receipt you can view; it isn't a downloadable document.

How the team splits the money internally is up to the Provider. HackenProof pays the Provider as one entity.

Solo Hacker vs. Provider Member

A hacker can access the same programs either way. What changes is who owns the work and who answers for it.

The accountability row matters most. Suppose a Provider member submits 300 spam reports through the Provider profile. The block lands on the Provider, not on the hacker's personal account. Everyone on the team shares that responsibility, so Providers have a reason to vet their members and review their output.

Independent researchers who are just starting are better served by a personal profile. Anyone weighing that path can learn more about becoming a bug bounty hunter.

Why HackenProof Built Providers

Many security firms already work this way: one company, a bench of researchers, and shared responsibility for the results. Providers let those firms work on HackenProof the same way they work everywhere else.

Providers also serve the companies that run programs. Not every organization wants to open its program to the whole hacker community. Some prefer to work with one known team of researchers that is accountable as a single entity. When companies are evaluating a bug bounty platform, the ability to bring in a vetted team instead of the open crowd can be what decides it.

For security firms, a Provider means one profile, one balance, and one reputation for the whole team. For program owners, it means a clear counterpart who answers for every report its members submit.

FAQ