> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt
> Use this file to discover all available pages before exploring further.

# HackerOne

> Connect HackerOne to Neo for report triage and Triage Summary automation

Use Neo as the first pass on HackerOne reports: fetch the submission, validate where possible, and produce a Triage Summary with verdict, evidence, impact, and next steps.

Three ways to run it:

* **Triage inbox** — connect in [Triage](https://neo.projectdiscovery.io/triage), browse a program queue, send reports to Neo
* **From Neo** — ask Neo to triage a report by ID or URL; the Triage Summary stays in Neo
* **From HackerOne** — a HackerOne automation starts Neo; the Triage Summary is posted back as an internal comment

<Info>
  Neo only posts internal Triage Summary comments for automation-started triage, and can create or update Neo-owned automations when you ask. It does not post public replies, change report state, assign bounty, or take other report-changing actions.
</Info>

## Setup

### Triage inbox

1. In HackerOne, create an organization API token under **Organization Settings > API Tokens** ([docs](https://docs.hackerone.com/organizations/api-tokens.html)).
2. Open [Triage](https://neo.projectdiscovery.io/triage), choose **HackerOne**, and enter the token identifier and token.
3. Select a program, review the queue, and start triage on a report. Neo starts a background task; open it from the toast or stay on the queue.

See [Vuln triage](/essentials/vuln-triage) for the multi-source inbox overview.

### From Neo (report ID or URL)

1. Connect HackerOne in Triage (steps above).
2. Start a Neo task and ask it to triage the report by ID or URL.

### From HackerOne (automations)

1. In HackerOne, open **Organization Settings > Automations > Secrets** (from `https://hackerone.com/organizations/<your_organization>/automations`). See HackerOne's [External Connectors](https://docs.hackerone.com/en/articles/11179569-external-connectors) guide.
2. Create these secrets with the exact names:

| Secret | Purpose |
| :- | :- |
| `neo_webhook_url` | `https://webhook.api.projectdiscovery.io/hackerone/webhook_events` (or a custom URL from your Neo account team) |
| `neo_api_key` | Your Neo API key from [Settings > API Key](https://neo.projectdiscovery.io/task?settings=api-key) |

3. With HackerOne connected in Triage, ask Neo to create or enable:

| Automation | Trigger | Result |
| :- | :- | :- |
| **neo on demand triage** | Internal comment includes `@neo triage` (or similar) | Triage starts; summary posted back to HackerOne |
| **neo auto triage** | New report submitted | Initial triage; summary posted back to HackerOne |

Creating or updating automations requires an organization API token with Organization Administrator permissions.

<Frame>
  <img src="https://mintcdn.com/neo-app/E6htmlBiuiFdiwgF/images/enable-h1-automation.png?fit=max&auto=format&n=E6htmlBiuiFdiwgF&q=85&s=15c5c20314e70c011abdefccd6b3090b" alt="Enabling the HackerOne on-demand triage automation from Neo" width="1442" height="1376" data-path="images/enable-h1-automation.png" />
</Frame>

## Examples

Triage Summary in Neo:

<Frame>
  <img src="https://mintcdn.com/neo-app/E6htmlBiuiFdiwgF/images/h1-triage-in-neo.png?fit=max&auto=format&n=E6htmlBiuiFdiwgF&q=85&s=36fa89129acb3ac0144397c15309525c" alt="Triage Summary shown in a Neo task" width="1560" height="1630" data-path="images/h1-triage-in-neo.png" />
</Frame>

Triage Summary posted back to HackerOne:

<Frame>
  <img src="https://mintcdn.com/neo-app/E6htmlBiuiFdiwgF/images/h1-triage-in-hackerone.png?fit=max&auto=format&n=E6htmlBiuiFdiwgF&q=85&s=c0213497c47e97e4f7dd0783db523a4d" alt="Triage Summary posted back to a HackerOne report" width="1798" height="1828" data-path="images/h1-triage-in-hackerone.png" />
</Frame>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.