HackerOne's Decline: From Hacker-First to Enshittification
Original: What Happened to HackerOne?
Why This Matters
HackerOne's trajectory reflects broader tensions between community-driven security research and platform monetization under investor pressure.
Security engineer Joel Margolis, a HackerOne researcher since 2017 and program manager from 2018–2025, published a detailed critique arguing that HackerOne has undergone systematic decline—abandoning its hacker-first mission through AI-driven policy changes, ownership of researcher reports, and community trust erosion.
Joel Margolis, a security engineer with firsthand experience on both sides of HackerOne—as a bug bounty researcher since 2017 and a program manager across multiple large companies through 2025—published a long-form retrospective examining the platform's deterioration.
HackerOne was founded in 2011 by ethical hackers Jobert Abma and Michiel Prins after they successfully found vulnerabilities in 100 major tech companies including Google, Facebook, and Apple. At the time, ethical security research carried serious legal risk, including criminal prosecution. HackerOne's original mission was to create a legally safe, consensual space for researchers to report vulnerabilities and receive payment.
Margolis describes a 'Golden Age' from 2017–2020 when the company held regular Live Hacking Events (LHEs), bringing top global researchers together on-site with exclusive targets. Leadership was hacker-adjacent and deeply engaged with the community.
The critique covers several turning points: a growing 'profit problem' as investor pressure mounted; the introduction of AI tooling that researchers view as devaluing their work; policy changes around report ownership that contradict earlier assurances; and what Margolis calls 'enshittification'—a gradual degradation of the product experience for researchers in favor of corporate and enterprise clients. He also describes HackerOne's attempts to manage community backlash as insufficient and tone-deaf.
Margolis draws on years of both public and private conversations with HackerOne to support his account.