BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.
Programs / Box BB
NR Unrated
Box BB
Box BB HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Box BB? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Program metrics HackerOne · published

HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 3 Oct 2026.

What it pays, by severity

Critical $5,000 avg 18 reports indicative
High $2,000 avg 78 reports firm
Medium $268 avg 94 reports firm
Low $150 avg 36 reports firm

$295,000 paid to researchers in total, $102,300 of it in the last 90 days. Lifetime figure as HackerOne prints it: evidence this program has paid, not a promise about any one report.

Intake & responsiveness · last 90 days

Reports received
1,321
in 90 days
Resolved
229
all time, last one 8 days ago
Participants
177
hunters engaged
Response efficiency
96%
meeting its targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received · day by day, last 15 days 918–1,321
5 Sep 1,321 reports 3 Oct

Response targets it sets itself

First response
2 days
Triage
10 days
Bounty
30 days
Resolution
30 days

A target the program declared, not a measurement of it being met.

Getting in the door

Open to submit. Nothing HackerOne publishes stands between a hunter and a first report here.

Over 44 days (30 snapshots): intake up 723 reports; response efficiency down 3 points; 90-day payout up $68,300.

See how this programme’s report load compares to others →

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

182 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 luqii 4,320 117 / 144 81%
2 freesec 432 15 / 25 60%
3 m0chan 285 12 / 27 44%
4 yoghurtbrain 212 5 / 6 83%
5 mugalatoogin 207 3 / 23 13%
6 imran0x01 162 6 / 7 86%
7 gammarex 136 3 / 3 100%
8 h1-squirtle 91 3 / 9 33%
9 hamza_g 90 5 / 8 63%
9 yashvier_kosaraju 90 5 / 6 83%
11 h33tjev 88 4 / 4 100%
11 ninetynine 88 4 / 4 100%
13 antonade 74 0 / 6 0%
14 imran_nisar 69 3 / 8 38%
15 fr4via 64 0 / 0
15 shailesh4594 64 2 / 2 100%
17 brdoors3 57 0 / 14 0%
17 cdl 57 1 / 1 100%
17 geekninja 57 1 / 1 100%
17 noam_ 57 0 / 0
17 prateek_0490 57 1 / 1 100%
17 thaivu 57 1 / 1 100%
17 x0abcd_ 57 1 / 1 100%
19 h4x0r_dz 29 2 / 2 100%
24 hallworld 55 0 / 4 0%

Showing the top 25 of 182 credited on HackerOne.

Program profile HackerOne · imported

Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 30 Sep 2026.

Responsiveness
96% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Open
Launched
Aug 2026
Scope entries
38 HackerOne’s count

Scope

37 assets
AssetTypeEligibilityMax severity
account.box.com URL ✓ bounty Critical
Android Box Mobile App GOOGLE PLAY APP ID ✓ bounty Critical
api.box.com URL ✓ bounty Critical
app.box.com URL ✓ bounty Critical
Box Drive OTHER ✓ bounty Critical
Show all 37 assets
AssetTypeEligibilityMax severity
Box Tools OTHER ✓ bounty Critical
cloud.app.box.com URL ✓ bounty Critical
dl.boxcloud.com URL ✓ bounty Critical
http://api.box.com/2.0/collaborations/ URL ✓ bounty Critical
http://api.box.com/2.0/collections/ URL ✓ bounty Critical
http://api.box.com/2.0/events/ URL ✓ bounty Critical
http://api.box.com/2.0/files/ URL ✓ bounty Critical
http://api.box.com/2.0/folder_locks/ URL ✓ bounty Critical
http://api.box.com/2.0/folders/ URL ✓ bounty Critical
http://api.box.com/2.0/group_memberships URL ✓ bounty Critical
http://api.box.com/2.0/groups URL ✓ bounty Critical
http://api.box.com/2.0/invites/ URL ✓ bounty Critical
http://api.box.com/2.0/recent_items/ URL ✓ bounty Critical
http://api.box.com/2.0/search/ URL ✓ bounty Critical
http://api.box.com/2.0/shared_items/ URL ✓ bounty Critical
http://api.box.com/2.0/skill_invocations/ URL ✓ bounty Critical
http://api.box.com/2.0/users/ URL ✓ bounty Critical
http://api.box.com/2.0/web_links/ URL ✓ bounty Critical
http://api.box.com/2.0/webhooks/ URL ✓ bounty Critical
http://api.box.com/2.0/zip_downloads/ URL ✓ bounty Critical
http://app.box.com/master/content URL ✓ bounty Critical
http://cloud.app.box.com/notes URL ✓ bounty Critical
http://dl.boxcloud.com/2.0/zip_downloads/ URL ✓ bounty Critical
http://upload.box.com/api/2.0/files/ URL ✓ bounty Critical
iOS Box Mobile App APPLE STORE APP ID ✓ bounty Critical
m.box.com URL ✓ bounty Critical
notes.services.box.com URL ✓ bounty Critical
upload.box.com URL ✓ bounty Critical
http://api.box.com/2.0/comments URL out None
http://app.box.com/tasks URL out None
signrequest.com URL out None
sr-staging-1.com URL out None

HackerOne lists 38 scope entries; its public listing groups many assets under one label, so identical entries are shown once.