HACNEX provides an independent responsible-disclosure channel that allows security researchers to report vulnerabilities identified during authorized security testing, including to companies that do not already have a HACNEX account or paid program.
This public VDP is a reporting channel, not an authorization mechanism. A HACNEX account or submission does not give permission to test a company, website, application, API, or infrastructure.
Researchers must obtain appropriate authorization before performing security testing and are responsible for complying with applicable law, applicable security policies, and the target's disclosure requirements.
The upcoming HACNEX Researcher Competition is planned to include up to 200 participating companies. Registered researchers will be notified when the participating-company directory and applicable reporting scopes are published.
Once a company is officially published as active for the competition, researchers can open its listing, review the authorized scope and reporting requirements, and use the designated report flow.
A researcher can use the public form when they identify a security vulnerability during authorized security testing and want a structured way to notify the affected company.
HACNEX verifies the supplied PGP key with GnuPG and encrypts the sensitive vulnerability package before persistent storage and delivery.
The company receives the encrypted report at the Security Email supplied for that particular submission. Replies can be associated with the HACNEX submission thread.
A company can receive security research without first joining a paid HACNEX program. The researcher supplies the destination Security Email and the company's PGP public key, allowing the report to be routed directly to the intended security contact.
This gives companies another reporting channel for responsible disclosure and helps them receive reports from researchers conducting authorized security testing.
During each three-month competition period, researchers with the highest eligible HACNEX points may receive cash prizes. Points are subject to HACNEX administrative validation; submitting a report alone does not automatically award points or payment.
Rewards are subject to eligibility requirements, validated points, competition rules, and the published reward terms.
Confirm that you are authorized to perform security testing against the target.
Identify a security vulnerability during the authorized testing.
Collect the company website, affected URL, Security Email and PGP public key.
Use the PGP verification button to confirm that the supplied key is valid and encryption-capable.
Log in or create a researcher account and submit the report.
The encrypted report is sent to the Security Email supplied for that submission.
The confidential vulnerability package is encrypted for the supplied company PGP key.
The email explains that a security researcher used the HACNEX public submission form and includes the submission reference.
HACNEX administration can review the submission and determine whether it qualifies for points, rewards, or another status under the applicable rules.
A report does not receive points simply because it was submitted.
HACNEX review or acceptance of a report does not provide authorization to continue testing the target.
Researchers must only test systems they are authorized to test and should follow applicable law and the target's published disclosure rules.
HACNEX is an independent reporting intermediary and does not grant permission to test any company, website, application, API, or infrastructure. HACNEX does not represent the target company and cannot guarantee acceptance, remediation, payment, or any action by the company.
Use the public Plan 3 submission form after confirming that your testing was authorized. You can open the form and fill in the fields before logging in; an authenticated researcher account is required when the report is actually submitted.
Go to Public VDP Submission