Tor Project launching a bug bounty program with HackerOne, sponsored by Open Technology Fund
Context & Ripple Effects
The HackerOne platform that launched last year takes a 20% cut of every bounty while routing white-hat reports to member companies — and now a government-funded anonymity project is its newest client. The Open Technology Fund's sponsorship means the Tor Project gets external security review without diverting its own budget.
It also marks an early test of whether bounty platforms work beyond commercial software: Tor's codebase protects users under repressive regimes, the same populations the Fund was created in 2012 to reach, so a critical flaw patched quietly has direct human-rights value.
First-order effects
- Security researchers gain a paid, structured channel to report Tor vulnerabilities instead of ad hoc disclosure, with HackerOne earning its commission on each valid report.
Second-order effects
- Other makers of security-sensitive consumer products faced the same playbook: OnePlus later opened a $50–$7,000 bug bounty program alongside a HackerOne partnership, and Huawei followed with an invite-only Android program paying up to $220,000.
Third-order effects
- If nonprofits, handset makers, and state-adjacent projects all converge on the same intermediary, vulnerability disclosure becomes platform-mediated infrastructure — by late 2023 HackerOne reported $300M+ in cumulative rewards, concentrating both researcher supply and disclosure relationships in one marketplace.
The trend: Paid vulnerability disclosure is consolidating around platform intermediaries like HackerOne, pulling in everyone from censorship-resistance nonprofits to consumer hardware vendors.