security · built by hackers

Security you can audit, not just trust.

encrypt · verify · isolate · disclose.

We're a platform for hackers, so we hold ourselves to a hacker's bar. Messages are end-to-end encrypted, skills are lab-verified, analytics are opt-in, and every researcher has a real way to report a bug — with a bounty attached.

e2e-encrypted DMs lab-verified skills in-house bounty
E2E
encrypted messaging
24h
sev1 triage target
0
plaintext DMs stored
100%
per-account isolation
private by construction

End-to-end encrypted
direct messages.

Hackers swap findings, payloads and write-ups in DMs without us — or anyone else — reading the contents.

ECDH-P256 key exchange

Every account holds an elliptic-curve keypair. Messages are encrypted in your browser to the recipient's public key — the server only ever sees ciphertext.

Per-recipient envelopes

Group threads encrypt a separate envelope for each member. No shared plaintext, no server-side fan-out of readable content.

Scrubbed on delete

Delete a message and the stored ciphertext is overwritten, not just flagged. What's gone is gone.

proof over promises

A skill model you can audit.

Anyone can claim "expert in web exploitation." On hacking.community, the claim is backed by evidence a company can actually check.

  • Sibling-lab verification · Skills are demonstrated under observation on infrastructure we control — nobody can fake a shell.
  • Karma-ranked reputation · Signal accumulates from real solves, writeups, and accepted findings, not endorsements.
  • Identity verification (opt-in) · Stripe Identity gates access to private programs and sensitive flows.
  • Integrity-scored reports · Every bounty submission carries an AI-fingerprint + coherence score to keep the signal high.

Lab-verified profiles

Verified badges map to solved labs anyone can inspect — the profile is the work, not a bullet list.

Escrow-backed bounties

Company payouts are held in Stripe escrow and released on triage approval. Hunters see a real number, not a promise.

the boring stuff, done right

Platform hardening.

The controls that don't make a demo but do keep your data safe.

Verified payment webhooks

Stripe events are signature-verified and re-checked against the Stripe API before any entitlement is granted. Forged webhooks are rejected at the door.

Brute-force protection

Login is rate-limited per account with automatic lockout; password-reset requests are throttled — keyed on the true client IP behind our edge.

Isolated accounts

User and payment data live behind strict per-account authorization — denied at the query layer, not just the UI.

SSRF-guarded fetches

Server-side image and link fetches resolve and block private, loopback and cloud-metadata addresses before making a request.

Secure sessions

HTTP-only, secure cookies with SameSite protection and server-side expiry + revocation. Stale tokens can't be replayed.

Continuous review

Passwords are bcrypt-hashed, secrets stay in environment config, and every release runs through code review and security regression tests before it ships.

found a bug?

We'd love to
hear about it.

We run an in-house bug bounty — report a vulnerability and you get tracked, scored, and (where the program is funded) paid. First-blood hunters are immortalised on our Hall of Fame. Sev1 triaged within 24 hours.

contactsecurity@hacking.community
policy/legal/security
metadata/.well-known/security.txt
hall of fame/bounties/hall-of-fame
sev1 triage< 24 hours

Practice, compete, and message with confidence.

The same people who build security tooling built this platform. It shows.

// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.