Skip to main content
Not every program on Hackrate appears in the public catalog. Private programs are invite-only engagements where the company has chosen to work with a curated group of researchers rather than the entire Hackrate community. These programs are not discoverable through catalog browsing — you can only access them after receiving an invitation or being accepted through an application process. Private programs are typically used by organizations with more sensitive systems, higher security maturity, or specific requirements around which researchers they work with. They often offer higher bounties, more focused scope, and more direct communication with the security team. Building a reputation that earns you private program access is one of the most valuable long-term goals for a Hackrate researcher.

​
How private programs differ from public ones

Not listed in the catalog

Private programs do not appear as clickable cards in the public catalog. You may see a locked placeholder card indicating a private program exists, but you cannot view any details without access.

Invitation or application required

You need either a direct invitation from the program owner or an accepted application to gain access. Browsing or submitting reports without access is not possible.

Curated researcher pool

Program owners choose exactly who participates. This gives companies confidence in who is testing their systems and lets them build ongoing relationships with trusted researchers.

Submit reports only after acceptance

Even if you know a private program exists, you cannot submit a report against it until you have been formally accepted. Submissions from non-accepted researchers are rejected automatically.

​
How to get access to a private program

There are two routes to joining a private program:

​
Route 1: Direct invitation from the program owner

Program owners can invite specific researchers directly based on their Hackrate profiles. If you receive an invitation:
  1. You will be notified through the platform and by email.
  2. The program appears in your Dashboard under Invites for a limited period (12 days from the invitation date).
  3. Accept the invitation to gain full access to the program scope, policy, bounty table, and report submission form.
Invitations expire after 12 days if not accepted. If you miss the window, you will need to contact the program owner or wait for a new invitation. Check your platform dashboard and notifications regularly so you do not miss time-sensitive invites.
Some programs provide a public application link that lets any researcher express interest in joining. When such a link is available, you can submit an application — this creates an access request that the program owner reviews before granting or denying access. The application process is straightforward:
1

Find the application link

Public invitation links are shared by program owners through Hackrate communications, their company’s security page, or community channels. You will not find them in the catalog itself.
2

Submit your application

When you open an application link while signed in to Hackrate, your application is recorded. Your public profile — including your nickname, reputation score, verified status, and submitted work history — is what program owners use to evaluate you.
3

Wait for a decision

Program owners review applications at their own pace. There is no guaranteed timeline. Building a strong reputation on public programs makes your application more compelling.
4

Access granted or declined

If accepted, the program appears in your Dashboard under Applied Programs. You can then access the full program page, review scope and policy, and begin submitting reports. If declined, you will be notified — this does not prevent you from applying to other programs.

​
What changes once you are accepted

After acceptance, your experience is similar to a public program — but with some meaningful differences:
  • The full program page is unlocked. You can read the complete scope, policy, bounty table, and any announcements that were previously hidden from you.
  • The report submission form is active. You can submit vulnerability reports directly to the program.
  • Your accepted status is recorded. Your access is tracked through a platform access record linked to both you and the program. This cannot be transferred or shared.
  • Higher expectations apply. Private programs typically expect higher-quality reports, strict adherence to the program policy, and more professional communication than a general public program might. Program owners have chosen to work with you specifically — represent yourself accordingly.
Access to a private program does not mean unlimited testing. You are still bound by the program’s scope and policy. Test only in-scope targets, during permitted testing hours, and within the rules set out in the program policy. Access can be revoked if you violate these terms.

​
Building toward private program invitations

If you are new to Hackrate and do not yet have access to any private programs, the most reliable path is consistent, high-quality work on public programs. Program owners watch the leaderboard and public researcher profiles when deciding whom to invite.

Earn reputation points

Reputation is the primary signal program owners look at. Every valid finding on a public program earns reputation points. Aim for steady growth rather than chasing a single large bounty.

Get identity verified

Verified researchers receive significantly more private program invitations. The verification badge signals to program owners that you have passed identity and trustworthiness checks. Complete your verification as early as possible.

Write high-quality reports

Reports that are clear, well-documented, and reproducible on the first read reflect positively on you. Program owners remember researchers who make their triage process easy.

Aim for the leaderboard

The Hackrate leaderboard ranks researchers by reputation, impact, and valid report count. Appearing on the leaderboard — especially in the top positions — makes you highly visible to program owners actively searching for researchers to invite.
The Hackrate Elite Club is reserved for the most trusted and accomplished researchers on the platform. Elite members receive priority consideration for all private program invitations. Working toward Elite status is the single most effective way to maximize your private program access over the long term.