HackerOne
Connect HackerOne to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect HackerOne to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| HackerOne's guide | docs.hackerone.com |
Connect with an API token
-
In HackerOne:
- As a program administrator in HackerOne, go to Organization Settings › API Tokens.
- Click Create API Token.
- Enter an identifier for the new API token (for example safeguard).
- Select the group(s) to add the token to: the token inherits the permissions of its groups, so choose a group with only read access to the programs Safeguard should read. With no group selected it has no access rights.
- Click Add API token, store the generated API token, then click I have stored the API Token.
- To change access later, click the kebab menu (three vertical dots) next to the token, click Edit api token, then click Manage groups for this API token. Keep Organization Admin permissions toggled off.
Where to find the other values:
- API identifier: The identifier you entered when creating the token; it is the username for HTTP Basic authentication (the token value is the password).
- Program handle (optional): Your program's handle.
HackerOne shows the secret only once, so copy it before you leave the page.
Source: docs.hackerone.com, checked 2026-10-07.
The permissions Safeguard needs:
Report viewer. -
On Compliance › Connectors, open HackerOne, click Connect, choose API token and fill in:
Field What to enter API identifier Required. API token Required. Stored encrypted and never shown again. Program handle (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read HackerOne and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 2 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 2 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 2 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks