hackerone-reports is a curated dataset and web interface that aggregates the top disclosed security vulnerability reports from HackerOne.
The project solves the problem of discovering high-impact, real-world security vulnerabilities by collecting and organizing HackerOne's publicly disclosed reports. It maintains a CSV database of report metadata fetched through automated scripts that use Chromium to scrape the HackerOne platform. The data pipeline consists of four sequential Python scripts: a fetcher that collects reports, a uniquer that deduplicates entries, a filler that enriches missing data, and a rater that scores reports. The results are published both as a live website and as markdown files organized by severity metrics and vulnerability type.
Security researchers and bug bounty hunters should adopt this tool to study real-world exploitation techniques and vulnerability patterns. The project is most useful for those learning from disclosed reports or benchmarking their own findings against industry standards. It surfaces reports across a comprehensive range of vulnerability categories including XSS, SQL injection, IDOR, RCE, SSRF, CSRF, XXE, and many others, making it valuable for understanding which bug types command the highest bounties or community recognition. The tool organizes findings both by overall impact (upvoted and paid rankings) and by specific vulnerability type, allowing targeted research into particular attack vectors.
The project maintains an active update cycle through its automated scraping pipeline, with scripts designed to be run sequentially to keep the dataset current. The codebase is straightforward and self-documenting, with each script containing embedded information about its function. The tool's reliance on Chromium and chromedriver for scraping indicates an ongoing commitment to working around potential access restrictions on the HackerOne platform.
