Question 1

Who can participate?

Accepted Answer

Researchers who submit at least one valid vulnerability report and received a payout according to the Bug Bounty program terms and conditions are eligible to participate in the Hacker Plus program. Other eligibility criteria includes: 1. Participants must not be subject to US trade sanctions and/or economic restrictions. 2. Participants under the age of majority in their own country must be accompanied by a parent or legal guardian for certain rewards (e.g. travel and event participation). Rewards and participation are subject to program terms and conditions.

Question 2

How do I join a league or know what league I’m in?

Accepted Answer

Once you meet the qualifications for a league, you will receive a notification within Facebook and a badge for the league will be posted to your researcher profile. You will also receive notifications as you approach the qualifications for the league above your existing one.

Question 3

How is score and SNR calculated?

Accepted Answer

A detailed breakdown of how score and SNR is calculated can be found here. It’s important to note that Hacker Plus applies scoring and SNR calculations to all reports you have submitted in the previous 12-month period. The Leaderboard page is separate from the Hacker Plus program and is calculated based on all reports received for the calendar year.

Question 4

Is it possible to drop down a league?

Accepted Answer

Once you reach a certain league, that level is set for 12 months. If you achieve the qualifications for a higher league, you will be promoted immediately. 12 months from the date that you qualify for a league, Meta will begin to reevaluate your participation. If you have failed or fail to meet one of the criteria for a continuous 12 month period, then you will be downgraded to the league that is 1 league less than your current league.

Question 5

Will my rating be public?

Accepted Answer

On your researcher profile page (https://www.facebook.com/whitehat/researcher-settings/), you have the option to make part of your researcher profile public, including things like the profile banner, badges you received and researcher metrics such as score & signal. If you choose to share your information through this feature, your name will be displayed on our leaderboard alongside your Hacker Plus league & Facebook profile picture. This leaderboard is public and others, including people without a Facebook account, may use it or share it with third parties.

Question 6

Why do you need this program in addition to your existing leaderboard?

Accepted Answer

The mission of Hacker Plus is to offer additional recognition and rewards to our researcher community for their significant contributions to our Bug Bounty program and the security of our services. We also hope to foster a community among the researchers who actively participate in our program and provide a place for researchers to collaborate and share their learnings. While our Leaderboard page ranks researcher contributions within a specific calendar year, Hacker Plus provides a snapshot of a researcher’s contributions and scores in the previous 12 month period.

Question 7

When are rewards distributed?

Accepted Answer

Here's a summary: Multiplier bonus payouts are issued whenever you are awarded a bounty for a valid submission. You must reach the Platinum or Diamond league 120 days prior to an event date to receive an invitation and travel/accommodation to the event. Meta requires at least 90 days advance notice and prior approval for campus visit rewards. Swag and merchandise are typically distributed between January - April each calendar year.

Question 8

Which Meta events would I get access to if I reach Platinum or Diamond League?

Accepted Answer

The following is subject to change according to company travel policies. That’s up to you! We have security teams you can visit headquartered in: Menlo Park, CA, United States Seattle, WA, United States New York City, NY, United States London, UK Tel Aviv, Israel. All event invitations are subject to program terms and conditions.

Question 9

What badges can I earn?

Accepted Answer

Each league has a dedicated badge which will be displayed in your researcher profile. Hacker Plus also recognizes our researchers for other Bug Bounty program achievements including: FBDL submitted reports, Donated bounties, Private bounty payouts, Valid Reporting.