# Connect HackerOne to GitHub

> Connect your bug bounty program to your development workflow so security findings get fixed faster and your code ships safer.

**Canonical page:** https://tray.ai/connectors/hackerone-github-integrations/
**HackerOne connector:** https://tray.ai/connectors/hackerone-integrations/
**HackerOne documentation:** https://tray.ai/documentation/connectors/service/hackerone
**GitHub connector:** https://tray.ai/connectors/github-integrations/
**GitHub documentation:** https://tray.ai/documentation/connectors/service/github

## Overview

HackerOne is the world's leading bug bounty and vulnerability disclosure platform. GitHub is where development teams manage their code, issues, and pull requests. Together, they close the gap between security researchers and the engineers who fix what they find. Without an integration, the handoff between the two is manual, slow, and full of opportunities for findings to get lost.

Security teams using HackerOne get a constant stream of vulnerability reports, but turning those findings into engineering work means manual data entry, status updates, and follow-ups across disconnected tools. Connect HackerOne to GitHub and every validated vulnerability can automatically become a tracked GitHub Issue or get linked to a repository milestone — no finding gets dropped. Engineers stay in GitHub, where they already work, while security teams keep full visibility in HackerOne. When a developer closes an issue or merges a fix, HackerOne updates automatically. Less back-and-forth, faster mean time to remediation, and a cleaner audit trail that satisfies both productivity and compliance requirements.

## Use cases

### Auto-Create GitHub Issues from HackerOne Reports

When a vulnerability report on HackerOne is triaged and validated, automatically create a corresponding GitHub Issue in the relevant repository with full context, severity, and reproduction steps. No more manual copy-paste between security and engineering. Developers can start remediation immediately, without waiting for a security team member to file a ticket.

- Eliminates manual ticket creation and cuts handoff time from hours to seconds
- Every validated finding is traceable in the engineering workflow
- GitHub Issues arrive pre-populated with HackerOne severity, CVSS score, and researcher notes

### Sync HackerOne Report Status from GitHub Issue State

When a developer closes a GitHub Issue tied to a HackerOne report, automatically update the report status in HackerOne to 'Resolved' or the appropriate stage. Developers never need to log into HackerOne. The sync also triggers disclosure timelines and researcher reward notifications on the HackerOne side.

- Cuts manual status update work for security operations teams
- Researcher payouts move faster because reward workflows fire on resolution
- Produces a consistent, auditable timeline of remediation activity

### Escalate Critical Vulnerabilities to GitHub Projects

When a HackerOne report comes in as Critical or High severity, automatically add the corresponding GitHub Issue to a designated security sprint or GitHub Project board. The most dangerous findings are immediately visible to engineering leads and land in the next sprint cycle. Teams can set severity thresholds to control what triggers escalation.

- High-severity vulnerabilities enter the engineering backlog without delay
- Engineering managers get real-time visibility into critical security work
- High-impact findings don't get buried in an unmonitored queue

### Link HackerOne CVE Disclosures to GitHub Security Advisories

When a HackerOne vulnerability is confirmed and a CVE is assigned, automatically draft or publish a corresponding GitHub Security Advisory in the affected repository. Open-source maintainers stay compliant with coordinated disclosure norms, and downstream dependents get notified through GitHub's advisory ecosystem. Advisory content stays consistent with the original HackerOne report.

- CVE disclosure workflows move faster for open-source and enterprise projects alike
- GitHub Security Advisories are created promptly and accurately
- Consistent disclosure documentation reduces compliance risk

### Notify Development Teams via GitHub Commits and PR Comments

When a HackerOne report references a specific code area or component, automatically post a comment on related open pull requests or recent commits to alert developers of the active vulnerability. The finding surfaces exactly where code changes are happening, so developers can address it before anything merges to production.

- Security context appears directly inside developer workflows in GitHub
- Vulnerable code patterns don't get merged while a report is open
- Less friction in cross-tool communication between security and dev teams

### Track Remediation SLAs Using GitHub Milestone Deadlines

When a report is triaged, automatically create GitHub Milestones with due dates based on HackerOne's severity SLA policies. Issues linked to a vulnerability get added to the milestone, giving engineering managers a clear deadline view. When a milestone is missed, a re-escalation workflow fires back in HackerOne to flag the overdue report.

- SLA deadlines are visible inside GitHub, where engineers actually work
- Overdue vulnerabilities escalate automatically, no manual monitoring needed
- An auditable SLA record is available for compliance and security reviews

### Aggregate HackerOne Program Metrics into GitHub Wikis or Repos

On a schedule, pull summary statistics from HackerOne — report volume, average time to triage, resolution rates — and commit them as markdown reports to a GitHub repository or Wiki page. Leadership gets a centralized, version-controlled view of security program health without needing access to HackerOne dashboards.

- Security program reporting lives in a tool engineering leaders already use
- A version-controlled history of vulnerability program performance builds up automatically
- Manual reporting work drops for security team leads and managers

## Templates

### HackerOne Validated Report to GitHub Issue

Automatically creates a detailed GitHub Issue whenever a HackerOne vulnerability report moves to 'Triaged', mapping severity, CVSS score, and reproduction steps from the report into the issue body and labels.

Connectors used: HackerOne, GitHub

### GitHub Issue Closed to HackerOne Report Resolution

Monitors GitHub for Issues tagged with a HackerOne report ID and, when closed, automatically updates the linked HackerOne report to 'Resolved', adds a resolution comment, and triggers the bounty payout workflow.

Connectors used: GitHub, HackerOne

### Critical Severity HackerOne Report to GitHub Project Escalation

When a HackerOne report is rated Critical or High, instantly creates a GitHub Issue and adds it to a designated security GitHub Project board column, notifying the on-call security engineer via a GitHub assignment.

Connectors used: HackerOne, GitHub

### HackerOne CVE to GitHub Security Advisory Draft

When a CVE is assigned to a HackerOne vulnerability, automatically creates a draft GitHub Security Advisory in the affected repository, pre-populated with the vulnerability description, affected versions, and CVE identifier.

Connectors used: HackerOne, GitHub

### Scheduled HackerOne Metrics Report Committed to GitHub

Runs weekly to fetch HackerOne program statistics — open reports, average MTTR, bounty spend — and commits a formatted markdown summary to a designated GitHub repository for stakeholder review.

Connectors used: HackerOne, GitHub

### New HackerOne Program Invitation Synced to GitHub Team Access

When a new researcher is formally added to a private HackerOne program, automatically grants them read access to a designated GitHub repository containing program-specific scope documentation, integration test environments, or security tooling.

Connectors used: HackerOne, GitHub

## Challenges Tray.ai solves

### Maintaining Bidirectional Status Sync Without Duplication

Keeping HackerOne report states and GitHub Issue statuses in sync is genuinely tricky. Updates on either side can trigger redundant loops, duplicate comments, or conflicting status changes if the integration isn't carefully orchestrated.

**How Tray.ai helps:** Tray.ai's workflow logic lets teams add conditional checks and idempotency guards so status updates only propagate when something actually changed. Loop prevention is built directly into the workflow using state-awareness conditions, not bolted on afterward.

### Mapping Severity Schemas Between Platforms

HackerOne uses CVSS scores and its own severity taxonomy (Critical, High, Medium, Low). GitHub uses free-form labels and priority systems. Translating between them without losing nuance requires careful field mapping, and that mapping can break whenever either platform updates its schema.

**How Tray.ai helps:** Tray.ai's data mapping and transformation tools let teams define explicit severity translation logic with version-controlled workflow configurations. When platforms change, updating the mapping is straightforward, and label application stays consistent across GitHub repositories.

### Routing Reports to the Correct GitHub Repository

Large engineering organizations can have hundreds of GitHub repositories. A HackerOne report needs to reach the right one based on the affected component, asset, or team. Getting this wrong manually is error-prone and slows down remediation.

**How Tray.ai helps:** Tray.ai supports dynamic routing logic that reads HackerOne report metadata — affected asset, program tags, component keywords — and matches it against a lookup table of repository names. Each issue lands in the right place automatically.

### Handling HackerOne API Rate Limits During Bulk Operations

Bulk report exports, historical data syncs, and scheduled metric pulls can all hit HackerOne API rate limits, leaving you with incomplete syncs or failed workflow runs that are hard to diagnose and resume.

**How Tray.ai helps:** Tray.ai has built-in retry logic, error handling branches, and configurable throttling controls so workflows handle rate limit responses gracefully. They pause, resume, and alert operators when something needs attention rather than failing silently.

### Securing Sensitive Vulnerability Data in Transit

Vulnerability report details are highly sensitive. Reproduction steps, proof-of-concept code, and CVE identifiers need to move securely between HackerOne and GitHub — premature disclosure or exposure in logs is a real risk.

**How Tray.ai helps:** Tray.ai encrypts data in transit, supports token-based authentication for both HackerOne and GitHub API connections, and lets teams redact or mask sensitive fields within workflow steps. Vulnerability data stays compliant with responsible disclosure policies throughout.

## Learn more

- Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/
- Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/
- Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/
- Book a demo: https://tray.ai/contact/