Kit vs HackerOne: Researchers and report handling
HackerOne combines a researcher community, managed triage and a free VDP tier. Kit provides intake, response deadlines and bounty records for your own team. It brings no researchers.
Which fits your team?
Kit fits teams that need:
- A record of how their team handles reports
- Monthly billing without a sales quote
- Intake for researchers who find them independently
- Response deadlines, a ledger and exports
- A security.txt and anonymous intake form
HackerOne fits teams that need:
- A researcher marketplace
- Researchers actively testing their assets
- Managed triage
- A security REST API
- Essential VDP's attestation reports
- A managed-service contract
What HackerOne does well
A researcher community, free attestation reports and managed triage.
A researcher community
HackerOne reports more than two million researchers. Programs can be discovered by researchers with profiles, reputation scores and disclosure histories.
In practice: Kit has no community to bring researchers to your program.
Free attestation reports
Essential VDP includes attestation reports that document your VDP for common frameworks.
In practice: If those records meet your requirements, a paid tool may add little.
Managed triage
HackerOne's triage staff review submissions, investigate duplicates and request working proof of concept before passing findings to engineers.
In practice: That review work is included in the managed service. Kit leaves it to your team.
What Kit includes
Each report gets a deadline and a reminder, so none sits unanswered while you ship. Kit brings no researchers or managed triage.
Researchers see missing payout paperwork
The report page shows whether an agreement, tax form or payout details are missing. Researchers accept the recorded agreement by clicking a button. Rejected tax forms include a reason.
Researchers can complete the missing step from their own report page.
The next action on each report
Kit highlights the current step: Assignment, Assessment, Decision or Bounty. Moving a report backward requires a comment. Idle reports trigger reminders, then an escalation to admins.
The report shows what needs doing, and its owner cannot mute the final escalation.
An acknowledgment deadline
Reports start a 72-hour acknowledgment clock by default, with warnings as the deadline approaches. Needs Clarification pauses the clock and idle-report reminders.
The dashboard records response and resolution times for your team's reports.
Triage tools for your assistant
Connect an MCP client to read reports and use guided prompts for triage, assessment, bounty approval and postmortems. Write access requires consent and the appropriate role.
Researcher replies are saved as drafts unless an admin enables direct sending. Reporter text is marked as untrusted.
What Kit doesn't have
Check these limits before choosing Kit.
Closing duplicates against an original
HackerOne can close a report as a duplicate of an original and add its reporter to that report. Kit flags likely duplicates but keeps their records separate.
Will we add it? A merge function is not scheduled.
A standalone free tier
Kit has no free plan. Every seat is paid once the 30-day trial ends.
Will we add it? A standalone free VDP is not planned.
Managed triage
HackerOne offers staff to validate, deduplicate and rate incoming reports. Kit screens submissions and flags likely duplicates, but your team reviews them.
Will we add it? No. Kit will not run a triage service.
Researchers
HackerOne has a researcher community that can discover your program. Kit receives reports through the channels you publish and recruits no researchers.
Will we add it? No. Kit will not run a researcher marketplace.
A security REST API
HackerOne documents REST access to reports, activities and status changes. Kit's security queue uses MCP and webhooks, with no REST API.
Will we add it? A security REST API is not scheduled.
How each works
The difference in day-to-day use.
For whoever answers security reports on top of their job
Every $8 Kit seat includes the Security workflow: intake, triage, SLAs, bounty records, and exports. Your team validates findings and handles any payouts.
Researchers and managed services
HackerOne connects security teams with researchers and offers managed triage. Essential VDP provides a free starting point for intake and attestation reports.
Plans and costs
Kit
$8/seat/month
Security workflow included in the $8/seat/month Kit subscription
- Security workflow included in every seat
- Triage board, append-only ledger and exports for your own SOC 2 audit
- Anonymous intake, branded portal and custom domain
- Monthly billing, no annual commitment
- Price published on this page, in your currency
HackerOne
Essential VDP: free. Paid tiers require a quote.
HackerOne publishes no prices for paid tiers
- Essential VDP: free, with no paid subscription required
- Paid VDP: request a sales quote
- Managed triage: pricing from sales
- Check Essential's current usage limits
- Review export and termination terms before adopting
Plans and costs
Kit publishes its $8/seat/month price and includes the Security workflow. Your team handles triage and any bounty payments.
Switching from HackerOne?
Consider Kit for:
- Recorded response times and report histories
- Published monthly pricing
- Acknowledgment deadlines
- A security.txt and embedded intake form
- Bounty paperwork handled by your team
Stay with HackerOne if you:
- Want researchers testing your assets
- Need managed triage
- Use the REST API
- Only need Essential VDP's included reports
Data portability: HackerOne documents CSV, Markdown and PDF exports as well as API access. Confirm what your tier includes and export before ending the service.
$8€6,9929,99 zł£5.99 per seat, per month
Get started free