Bug Bounty Process

The main difference is structure. AT&T on HackerOne feels more formal because the platform gives you fields, status updates, triage, and payout tooling. Mail.com is more personal and lightweight, but it also means the report has to be organized well from the start.

AT&T is the more structured process. HackerOne asks for a title, description, reproduction steps, weakness type, impact, and proof of concept. Triage may adjust severity, ask for more evidence, or mark a report as duplicate.

1. 01Create or log in to HackerOne, find the AT&T program, and read the scope before testing.
2. 02Confirm the affected asset and vulnerability type are eligible. Out-of-scope issues will not pay regardless of severity.
3. 03Fill out the report with a clear title, vulnerability description, reproduction steps, impact, and weakness type.
4. 04Attach proof of concept material such as screenshots or a short screen recording that shows the full issue.
5. 05Submit the report and respond to HackerOne triage if they need clarification, severity details, or duplicate checks.
6. 06Wait for AT&T internal review, then verify the fix if they ask after remediation.

Mail.com, and the related GMX.com program, use direct communication instead of a third-party platform. There is no preset report form, so the email needs to be clear enough to stand on its own.

1. 01Find the Mail.com or GMX.com responsible disclosure address and review the program requirements.
2. 02Write the report yourself as an email with the same structure you would use on a platform.
3. 03Include a title, affected URL or account flow, steps to reproduce, impact, and proof of concept attachments.
4. 04Send the email, wait for the security team to confirm receipt, and answer any follow-up questions.
5. 05If the finding is valid and in scope, provide payment details for bank transfer and decide whether to be listed publicly.

HackerOne handles the AT&T payout after tax and payment details are set up in the platform. Mail.com pays directly, usually through an international bank wire, so it can take longer even when the finding is accepted quickly.

AT&T disclosure is controlled through HackerOne and generally requires permission after the report is resolved. Mail.com handles disclosure by email, and Hall of Fame recognition is separate from payment.

HackerOne is easier to start with because the platform gives you a process. Direct programs like Mail.com can be more open-ended, but they reward clear writing and careful documentation. Both require patience, scope discipline, and proof that the issue is real.