HackerOne · #2291Triage
Coupon applied twice on one order
POST /v1/orders/:id/coupon
submitted by a researcher
07·Bug bounty
Internal findings and researcher reports.
A HackerOne or Bugcrowd report is reproduced, tied to the asset, and fixed in your code for you, so your engineers stay on what matters.
Works with
- HackerOne
- Bugcrowd
- GitHub
- GitLab
Fixed in your code
We treat a report like our own finding.
A HackerOne or Bugcrowd report is reproduced on the live system.The fix lands in your code the same way.
From a report to the fix
Four stages run on their own.
The report arrives, it is reproduced on the live system, tied to the asset, and fixed in your code like any internal finding.
- 01
The report arrives
Autonomous
From your team, or from HackerOne or Bugcrowd, connected the way the other sources are.
- 02
Reproduced live
Autonomous
Severity and the asset, then a live reproduction. Only what reproduces moves on.
- 03
Fixed in your code
Autonomous
MapperPlus fixes it in your code, the same way as an internal finding.
- 04
Merge request opened
Autonomous
Your engineers review it. The report and the fix point at the same asset.
We close the loop.
Report, review, live confirmation, the code fixed for you, then release.The same path for every finding.
The loop
Report in, merge request out.
A researcher report follows the same path as an internal finding: reproduced, tied to the asset, and fixed in your code.
Replaying on pay.acme.com
Reproduced 3 of 3
Traced to coupon.ts:88
acme / payments · !483Pipeline passed
Apply a coupon once per order
coupon.ts:88 · +2 −1 · fixes #2291
opened by MapperPlus
What it covers
Two programs, one path.
Your own program
Attack surface, live proof, and the code fixed for you.
A bounty program
Researcher reports are reproduced and fixed in your code, like your own findings.
Intake
HackerOne and Bugcrowd, connected the way the other sources are.
The same path
Report, review, live confirmation, the code fixed for you, then release.
We hand it to your team.
The fix arrives as a merge request.Your engineers review and ship.
Delivered
The finding lands where the team works.
Jira
A ticket, with severity and the asset.
Linear
An issue in the engineering queue.
PagerDuty
A page when the severity cannot wait.
What a finding carries
Every field the next team needs.
Source, asset, proof, and fix stay on one record from the report to the merge.
FindingMP-1842
- Source
- Internal, HackerOne, or Bugcrowd.
- Asset
- The host or endpoint the report names.
- Proof
- Reproduced on the live system, or still in review.
- Fix
- The code change, written for you.
Next in the path
Attack surface management- 01Attack surface managementThe map of hosts, DNS, and ports.
- 02Exposure discoveryNew subdomains, exposed servers, and every reachable host.
- 03Secret monitoringPublic JavaScript, read as it changes.
- 04Autonomous penetration testingPentested autonomously. Proved before it is reported.
- 05RemediationWe fix the code for you.
- 06AlertingThe finding lands in the queue that owns it.
See bug bounty on your own hosts.
Enter your domain. We map what is exposed and walk you through it in a live demo.
ISO 27001 certifiedNothing to installYour team merges every fix