Hackhub: Bug Bounty is a strategy, indie, and simulation title that places players in the role of a professional bug hunter on a coordinated disclosure platform. The experience centers on signing up to HackerNone, where companies compensate hunters for verifiable security flaws discovered in their websites. No one provides direct locations for the issues, so the work involves examining program pages for scope details, policies, payout structures, and competition levels before diving into site exploration, JavaScript analysis, terminal reconnaissance, and pattern recognition.
Gameplay
Core play revolves around realistic vulnerability discovery and documentation. The pack adds Borp, an intercepting proxy application that captures every browser request in a history log. Players can intercept and modify requests in flight or replay them repeatedly through a repeater tool with custom headers. Out-of-band confirmation comes from a collaborator system where payloads trigger logged callbacks to external domains, serving as proof for invisible findings.
Twenty-four real-world weakness classes are modeled, including IDOR, broken access control, JWT signature bypass, SSRF, path traversal, stored and blind XSS, SSTI, host header injection, subdomain takeover, committed secrets, business logic flaws, and race conditions. Each simulated target contains an actual exploitable issue rather than artificial flags. Reporting requires dragging relevant log steps into sequence, marking evidence, classifying the asset and weakness type, and answering questions that generate a CVSS vector. Players add their own impact description and any suggested fix. A triager reviews submissions after simulated time passes, delivering verdicts such as triaged, resolved with payout, needs more information, duplicate, informative, or not applicable.
Progression tracks two key metrics. Reputation accumulates across a career without decreasing and unlocks access to higher tiers of programs from startups through critical infrastructure. Signal reflects the average value of accepted reports and influences whether top programs continue reviewing submissions. Low signal from speculative reports can limit opportunities, while strong performance attracts private invitations.
Game Modes
The primary mode follows a structured career path across ten hand-crafted companies presented in approximate difficulty order. Sprocket Supply serves as the tutorial with a disclosure-only program and forgiving triage. Kestrel People and Peppermint emphasize reconnaissance through exposed admin routes and leaked credentials. Lumen Notes and Atlas Docs each hinge on a single flawed assumption in token handling or path filtering. Vantage Analytics requires out-of-band evidence for its blind issue and demands higher reputation. Northwind features rate limits and honeypots that issue warnings. Meridian Bank restricts access to invite-only with strict policies. Fitric shifts focus to mobile app decompilation. Corveil provides repository read access for code review findings.
After the initial set, procedural programs generate ongoing targets with unique web apps, APIs, test accounts, and genuine flaws. Leaderboards update in real time regardless of individual play sessions. Additional activities include timed live events on shared targets scored by severity and report quality, with bonuses for standout bugs or creative chains. Once signal reaches a sufficient level, players can take on paid triage work by evaluating other reports for accuracy.
Tools and Supporting Systems
Eight terminal utilities mirror real counterparts: amass, ffuf, arjun, gitleaks, jwt-tool, waybackurls, apktool, and a passive monitor that detects new assets over time. A sixteen-article handbook covers scope assessment, severity evaluation, report writing, and each weakness class. HackTales functions as an in-game blog with technique write-ups from fictional hunters. A narrative thread follows triager Mara Vega and a case involving duplicate submissions by another hunter, culminating in choices at a case desk. A broker appears after the first accepted critical, offering payment for exploits in exchange for silence. Four achievements track milestones.
Is It Worth Playing?
This content pack suits players interested in methodical simulation of security research workflows rather than action-oriented hacking. It emphasizes accurate tool usage, precise reporting, and reputation management within a single-player framework that incorporates procedural elements for replayability. The base game reached full release in August 2026 with very positive reception overall, and this upcoming October 2026 addition expands career-focused play without altering core systems. Those who value detailed procedural fidelity and long-term progression tracking will find the mechanics rewarding, while players seeking faster-paced or multiplayer-centric experiences may prefer other options in the genre.
