You can easily communicate with hackers through commenting within the report. On the report, select “Add comment” from the drop-down menu above the comment box. To ensure the comment is visible to the hacker who filed the report, select “All participants” from the next drop-down. The hacker will get a notification in the HackerOne profile, and will be notified by email as long as they have notifications for this report enabled. If you want to make sure they get the message no matter their notification settings, you can type @[hacker’s username] in the comment to address them directly.
Comment on Multiple Reports
You can also add a comment to multiple reports simultaneously. You select the reports from the Reports list that you want the comment to go to by clicking the check-box next to the report title. You will notice that a list of the titles of the selected reports populates in the center of the screen above the Comment field. You can select whether you want the comment to go to All participants or to your internal Team only. Type your comment and click the green “Post comment” button.
If you want to reach a larger group of hackers with a one-way announcement, use the Broadcast Messaging feature. Go to team Settings > Message Researchers. All programs can send an announcement to the “Top 20 researchers who have participated in your program” or to “Specific researcher(s) by username”, while invitation-only programs have the additional option to select “All invited researchers.” Use the “Custom” recipients field to describe a unique group that you want to message, like “All hackers on the HackerOne platform who have submitted 5+ reports.”
Once you have chosen your recipients, write your message, then click the green “Submit” button. That sends your message directly to HackerOne support, who verifies the content then delivers your message to the selected recipients within 1 business day. The message will appear from “Your Team (via HackerOne)” and will be no-reply.