The Node.js Project

UPDATE 2026-02-19: New researchers without signal can no longer submit reports through HackerOne. If you are a new researcher and would like to report a potential vulnerability, please reach out to the Node.js security release stewards through the OpenJS Foundation Slack.

We have updated our HackerOne program to require a Signal of 1.0 or higher to submit vulnerability reports to the Node.js project.

The Node.js security team has experienced a significant increase in low-quality reports. This trend has been increasing over the years, and over the holidays it crossed the threshold that we can actually handle. Between December 15th and January 15th, we received over 30 reports. Triaging these reports consumes time and energy that could be spent on legitimate security work.

By requiring a minimum Signal score, we ensure that reporters have a proven track record of submitting valid security reports, while still allowing newer researchers to participate with a limited number of submissions.

• New researchers or researchers with signal >= 1.0: You can continue reporting vulnerabilities through HackerOne as usual
• Those below the threshold: You can still reach the security team through the OpenJS Foundation Slack (channel: #nodejs-security-wg for help). Contact us directly using direct messages there to discuss potential vulnerabilities. You can find the users listed in security release stewards.

Signal is HackerOne's reputation metric that reflects the quality of a researcher's past submissions. A higher Signal indicates a history of valid, impactful reports. This requirement helps us prioritize reports from researchers with demonstrated expertise while reducing the burden of triaging invalid submissions.

We appreciate the security community's understanding and continued collaboration in keeping Node.js secure.