Node.js Updated HackerOne Program to Require a Signal of 1.0 or Higher to Submit Vulnerability Reports

Node.js has tightened its HackerOne vulnerability disclosure program by requiring a minimum Signal score of 1.0 to mitigate low-quality reports and improve processing efficiency after a spike in weak submissions. Researchers meeting the threshold can submit as usual, while those below it are encouraged to engage via the OpenJS Foundation Slack to establish credibility and understand expectations, reflecting a broader trend toward quality controls in bug bounty ecosystems.