HackerOne SDKs & Libraries: Official & Community Integrations (2026)

SDKs overview

HackerOne provides a platform for managing vulnerability disclosure programs and bug bounties, facilitating interaction between security researchers and organizations. To extend the platform's capabilities and integrate with existing developer workflows, HackerOne offers a RESTful API. Software Development Kits (SDKs) and client libraries are built upon this API, abstracting direct HTTP requests into language-specific functions and objects. These tools allow developers to programmatically access and manipulate HackerOne data, such as vulnerability reports, program details, and user information.

The core functionality supported by HackerOne's API and corresponding SDKs includes submitting new reports, updating existing reports, retrieving program data, and managing user access. This enables automation of tasks like synchronizing vulnerability data with internal issue trackers, generating custom reports, or triggering actions based on report status changes. The API follows a REST architectural style, commonly used for web services, and typically returns data in JSON format for easy parsing across different programming languages W3C JSON Data Interchange. Authentication to the HackerOne API is performed using API tokens, which are generated within the HackerOne platform and provide secure access to authorized resources HackerOne API authentication.

Official SDKs by language

HackerOne maintains official SDKs to provide robust and supported interfaces for interacting with their platform. These SDKs are designed to abstract the complexities of direct API calls, offering idiomatic methods for common operations. The official SDKs typically track the latest API versions and include features like request signing, error handling, and object serialization/deserialization. The primary official SDKs are available for Ruby, Python, and Go, reflecting common languages used in security operations and backend development. Each SDK is distributed through its respective language's package manager, simplifying dependency management and installation. Developers can consult the official HackerOne documentation for detailed API reference and SDK-specific usage guides HackerOne API documentation.

Installation

Installing HackerOne SDKs involves using the standard package manager for each target programming language. Before installation, it is recommended to have a stable version of the respective language runtime installed on your development environment. For example, Python SDKs typically require Python 3.x, and Ruby SDKs require a compatible Ruby version. After installation, you will need to configure the SDK with your HackerOne API credentials, which usually consist of an API key identifier and an API key. These credentials are generated within your HackerOne account settings, under the API Keys section HackerOne API token creation.

Ruby

The Ruby SDK is available as a RubyGem.

gem install hackerone

After installation, you can configure it with your API keys:

require 'hackerone'

HackerOne.configure do |config|
  config.api_key_identifier = ENV['HACKERONE_API_KEY_IDENTIFIER']
  config.api_key = ENV['HACKERONE_API_KEY']
end

Python

The Python SDK is distributed via PyPI.

pip install hackerone-client

Configuration in Python typically involves setting environment variables or passing credentials directly:

import os
from hackerone import Client

client = Client(
    api_key_identifier=os.environ.get('HACKERONE_API_KEY_IDENTIFIER'),
    api_key=os.environ.get('HACKERONE_API_KEY')
)

Go

The Go SDK can be fetched using go get.

go get github.com/hackerone/go-hackerone

Example configuration and client instantiation in Go:

package main

import (
	"context"
	"fmt"
	"os"

	hone "github.com/hackerone/go-hackerone"
)

func main() {
	client := hone.NewClient(
		os.Getenv("HACKERONE_API_KEY_IDENTIFIER"),
		os.Getenv("HACKERONE_API_KEY"),
	)

	// Example: Fetching user details (requires further API calls, this is client setup)
	// For actual data retrieval, refer to HackerOne Go SDK documentation for specific methods.
	fmt.Println("HackerOne Go client initialized.")
}

Quickstart example

This quickstart example demonstrates how to use the Python SDK to fetch a list of reports from a HackerOne program. It assumes you have already installed the hackerone-client package and configured your API key identifier and API key as environment variables (HACKERONE_API_KEY_IDENTIFIER and HACKERONE_API_KEY).

The example retrieves the first few reports for a specified program handle and prints their titles and current states. This illustrates a common use case: integrating HackerOne report data into internal systems for monitoring or further processing. The HackerOne API allows for filtering and pagination of results, which are important considerations for larger datasets HackerOne API reports endpoint.

import os
from hackerone import Client

# Initialize the HackerOne client with API credentials
# It's recommended to store these as environment variables for security
client = Client(
    api_key_identifier=os.environ.get('HACKERONE_API_KEY_IDENTIFIER'),
    api_key=os.environ.get('HACKERONE_API_KEY')
)

# Replace 'your_program_handle' with the actual handle of your program
program_handle = 'your_program_handle'

try:
    # Fetch reports for a specific program
    # The 'include' parameter can fetch related resources like 'reporter'
    # The 'page[size]' and 'page[number]' parameters control pagination
    reports_response = client.reports.get(
        program=program_handle,
        page_size=5,  # Fetch up to 5 reports per request
        page_number=1 # Start from the first page
    )

    print(f"Fetched {len(reports_response.data)} reports for program: {program_handle}")

    if reports_response.data:
        for report in reports_response.data:
            report_id = report.id
            report_title = report.attributes['title']
            report_state = report.attributes['state']
            print(f"  Report ID: {report_id}, Title: '{report_title}', State: {report_state}")
    else:
        print("No reports found or accessible for this program.")

except Exception as e:
    print(f"An error occurred: {e}")
    print("Please ensure your API keys are correct and you have access to the specified program.")

Community libraries

Beyond the officially supported SDKs, the HackerOne developer community has contributed various libraries and tools that interact with the HackerOne API. These community-driven projects often emerge to fill gaps in language support, provide specialized functionality, or offer alternative interfaces to the API. While not officially maintained by HackerOne, these libraries can be valuable resources for developers working in languages or environments not covered by the official SDKs. Examples might include JavaScript clients for frontend integrations, PowerShell modules for scripting, or libraries for less common backend languages. When considering community libraries, it's important to evaluate their maintenance status, documentation quality, and security practices, as they may not adhere to the same rigorous standards as official offerings Mozilla Open-source software considerations. Developers should check the respective project repositories (e.g., GitHub) for up-to-date information and community support.

Some common types of community contributions include:

• API wrappers in other languages: Enabling interactions for languages like JavaScript (Node.js), PHP, or C#.
• Command-line interface (CLI) tools: For quick scripting and automation directly from the terminal.
• Integration with specific platforms: Libraries designed to bridge HackerOne data with issue trackers like Jira, Slack notifications, or custom dashboards.
• Proof-of-concept (PoC) generators: Tools that help security researchers automate parts of their report submission process.

To find community-contributed libraries, developers typically search platforms like GitHub using keywords such as "HackerOne API client" or "HackerOne SDK" combined with their preferred programming language. The HackerOne platform itself, through its community forums or developer resources, may also highlight notable community projects.