New HackerOne Signal Requirement for Vulnerability Reports

UPDATE 2026-02-19 : New researchers without signal can no longer submit reports through HackerOne. If you are a new researcher and would like to report a potential vulnerability, please reach out to the Node.js security release stewards through the OpenJS Foundation Slack .

We have updated our HackerOne program to require a Signal of 1.0 or higher to submit vulnerability reports to the Node.js project.

The Node.js security team has experienced a significant increase in low-quality reports. This trend has been increasing over the years, and over the holidays it crossed the threshold that we can actually handle.