> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/dynamic-app-security/hackerone.md). # HackerOne ## HackerOne You can import HackerOne Bug Bounty reports into OX as DAST findings. Researcher-submitted vulnerabilities are then triaged, filtered, and reported next to the rest of your dynamic application security testing results. ### What OX imports from a HackerOne report OX creates one DAST finding per imported report. The finding keeps a link back to the report on HackerOne, so a reviewer can open the original submission. | OX finding | Source in the HackerOne report | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Title | The report title. | | Description | The vulnerability information written by the researcher. | | Severity | The report severity rating. Critical, high, medium, and low map directly, none maps to info, and an unrated report is imported as medium so it stays visible. | | CVSS | The severity score and vector of the report, when the report is rated. | | CWE | The weakness of the report, normalized to `CWE-`. A weakness that is not a CWE is dropped. | | CVE | The first CVE listed on the report, when the report carries one. | | Asset | The asset identifier of the structured scope. A report with no structured scope falls back to the program handle. | | Tags | The program handle, the reporter user name, and the current HackerOne state of the report. | | Link | The report page on HackerOne, reachable from the finding as the external product link. | | Created | The submission time of the report. | #### Report states that OX imports OX imports reports in the **New**, **Triaged**, **Pending Program Review**, and **Needs More Info** states. Reports in every other state are skipped, so duplicate, informative, not applicable, and spam submissions never become OX findings. Resolved and retesting reports follow the OX scan lifecycle. When an imported report leaves the active set, its OX issue resolves on the next scan. ### Prerequisites * **OX organization admin:** Only an organization admin can add or change a connector credential. ## Step 1: Create an API token \[HackerOne] 1. Sign in to HackerOne as an organization admin. 2. Go to **Organization Settings > API Tokens**. 3. Create a new API token. 4. Grant the token access to the programs you want OX to import. **Note:** A token that sees no programs cannot complete the connection in Step 2. 5. Copy the API token identifier and the API token value. The identifier is the user name, and the value is the token. ## Step 2: Connect HackerOne to OX 1. In the OX platform, go to the **Connectors** page. 2. Select **Add Connector** and search for **HackerOne** .
Complete the fields, then select **Verify Connectivity** to confirm the credentials, and select **Connect** to save them. | Field | What to use | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | HackerOne Host URL | The HackerOne API host. OX prefills `https://api.hackerone.com`, which is correct for the public platform. Change it only if your organization reaches the HackerOne API on another host. | | User Name | The API token identifier from Step 1, not the email address of a HackerOne user. | | API Token | The API token value from Step 1. OX stores it encrypted and never displays it again. | 3. Select **CONNECT**. 4. To select specific HackerOne programs to import, click the gear icon next to the **DELETE** button. 5. Select the HackerOne projects and select **SAVE**. When connected, OX starts pulling DAST data from Applause. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ox.security/ox-integrations/3rd-party-integrations/dynamic-app-security/hackerone.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.