I Analyzed HackerOne’s 100 Biggest Payouts Ever.

The biggest payout in HackerOne's recorded history for disclosed report didn't come from an exploit chain. No fuzzing farm, no months of reverse engineering, no exotic memory corruption.

It was a GitHub access token sitting in the open, with read and write access to Shopify's repositories. Shopify paid $50,000 for it.

Six separate PlayStation kernel bugs, each demanding real memory-corruption expertise, paid $10,000 apiece on the same leaderboard.

If bounty tracked difficulty, that math wouldn't work. So I broke down all 100 reports to find out where the money actually sits.

What I analyzed, and what the data can't tell you

The open-source repo hackerone-reports maintains two leaderboards built from disclosed HackerOne activity: the top 100 paid reports and the top 100 upvoted ones. I went through every entry on the paid list and categorized it by hand. Bug class. Program. Attack surface. Bounty.

Combined recorded bounties: $1,546,905 across 100 reports.

Three caveats before the findings.

This is an all-time snapshot, so older reports are overrepresented. Bounty figures are as recorded at disclosure; I can't see renegotiations after the fact. Every claim below links to the underlying report so you can check my work.

The most expensive bug was a secret nobody rotated

The number one report of all time is a leaked GitHub token. Number two is a leaked certificate in a git repository that gave API access to Uber's internal code review tooling. $39,999 for that one.

Seven of the top 100 payouts are leaked credentials or tokens. Combined: $162,299.

GitHub access token, Shopify, $50,000 (report)
Leaked certificate in git repo, Uber, $39,999 (report)
Leaked session cookie, HackerOne, $20,000 (report)
Token leak in security challenge flow, PayPal, $15,300 (report)
JFrog Artifactory credentials on GitHub, Snapchat, $15,000 (report)
CI runner tokens exposed via JSON serialization, GitLab, $12,000 (report)
Password reset token leak, Uber, $10,000 (report)

Why do secrets out-earn exploits? A valid token is its own proof of concept. There is nothing for triage to argue about. No debate over whether the reflection is exploitable, no preconditions to satisfy. The damage is one curl command away from certain.

That certainty is what the market prices.

Fourteen reports paid $282,299 for finding things that shouldn't be public

An unprotected Zeppelin notebook instance: $35,000. An exposed Kubernetes API with credentials included: $25,000.

A production Jenkins server: $15,000. Spring Actuator endpoints with broken authentication: $12,500. Internal Confluence docs: $12,500. Production Grafana dashboards: $10,000. A public SVN repository: $10,000.

None of these required bypassing anything. They were simply reachable. The skill that found them was noticing, systematically, at scale.

Recon discipline beat exploitation skill on 14% of the biggest payouts ever recorded.

One company collected 28 cents of every dollar

GitLab appears 25 times in the top 100. Combined: $438,220.

Eight of those sit in a single feature family: project import.

RCE via GitHub import, $33,510 (report)
RCE via BulkImports, $33,510 (report)
Arbitrary file read via the bulk imports pipeline, $29,000 (report)
Importing local git repos through RepositoryPipeline, $22,300 (report)
Stealing private objects via project import, $20,000 (report)
More private objects exposed through import, $20,000 (report)
Arbitrary file read during import, $16,000 (report)
SSRF via imported attachment URL, $10,000 (report)

That's $184,320 from one feature family on one product.

Import features move data across trust boundaries. Files get parsed. URLs get fetched. Repositories get cloned. Permissions get re-applied to objects that arrive from somewhere else. Each step is a decision the code can get wrong, and a mature product makes these decisions hundreds of ways.

The lesson isn't "hunt GitLab." It's that target selection outweighs bug-class mastery. A hunter who picks complex, data-moving products and learns them deeply competes against a much smaller queue than someone spraying the same XSS payloads at every program on the front page.

Months of kernel expertise paid the same as one forgotten dashboard

Six PlayStation kernel memory-corruption reports paid $10,000 each.

Use-after-free in socket option handling (1, 2), double frees in network paths (3, 4), integer overflow in a filesystem driver (5), kernel stack corruption (6). That is years of accumulated skill per report.

Eight memory-safety bugs in Shopify's Ruby scripting engine earned $88,000 combined (example).

Now compare. Open Jenkins instance: $15,000. Production Grafana dashboards: $10,000.

Read those numbers again if difficulty-equals-price feels intuitive. The market does not price effort. It prices what an attacker can do after the finding, and how fast triage can verify it.

This isn't an argument against deep skills. Kernel research makes you excellent at everything else you touch. But as a business decision, target selection and impact framing move the number more than technical sophistication does.

The community's favorite report earned $22,500

The most upvoted report in HackerOne history has 2,996 upvotes. Recorded bounty: $22,500. It described an account takeover path affecting Shopify logins for accounts without a Shopify ID.

A Steam client RCE via buffer overflow gathered 1,288 upvotes and $0. A SQL injection that extracted Starbucks' financial and payroll database gathered 797 upvotes and $0.

As noted above, disclosure data doesn't always show why a bounty reads zero. Some of these programs pay recognition instead of cash; some reports were ruled duplicates after the applause arrived. Whatever the reason in each case, the pattern holds.

Two leaderboards measure different things. Upvotes reward clever stories and elegant techniques. Payouts reward verified damage to assets a company is obligated to protect.

If income is the goal, study the second list.

What I'd hunt differently after this breakdown

Add exposed-service hunting to every recon pass. CI servers, dashboards, admin panels, monitoring tools, API endpoints that answer without authentication. Fourteen of the top 100 payouts came from this alone.
Treat secret exposure as a primary bug class, not a lucky accident. Build a repeatable process for checking public code, CI logs, and config dumps within program scope.
On mature programs, map the import/export/integration surface first and camp there. That's where trust boundaries multiply.
Write impact a triager verifies in minutes. A working token screenshot beats a theoretical chain. Certainty moves severity ratings.
Stop watching the applause leaderboard. It measures something you can't deposit.