YouGina

About a month ago, the 2024 edition of the HackerOne Ambassador World Cup officially came to an end. It was an incredible journey that spanned almost a year and concluded in May 2025. I’m proud to have been part of the Dutch team, and even more grateful to have been selected for the in-person stages of the event. Looking back, this was one of the most exciting and rewarding experiences in my bug bounty journey.

How it all began

The competition kicked off with a tough qualifying round where all participating countries competed for a limited number of spots in the group stage. With a bit of luck and determination, our team made it through.

The group stage

In the group stage, we faced strong teams from Saudi Arabia, Colombia, and Iraq. It was intense, but this time, we were confident and managed to secure our place in the Sweet Sixteen.

Sweet Sixteen: Comeback against Canada

Our next match was against Canada in the Sweet Sixteen round. From the start until almost the very end, they were ahead of us. But then, something clicked. Thanks to the hard work and incredible skills of my teammates, we pulled off a last-minute comeback and secured the win. It was one of the most thrilling moments of the tournament for us.

Elite Eight: In-person in Prague

The Elite Eight round was special, because it was the first in-person stage of the competition. This is also my first time participating in a Live Hacking Event. Eight of us were flown into Prague. While unfortunately only one member of the Nepal team could attend due to visa issues, it was great to meet with their Ambassador during the event.

Meeting the clients whose apps we were testing was a major highlight. We had valuable conversations that helped us better understand the scope and tailor our testing. HackerOne also treated us to a boat tour on the Vltava River, where we got to mingle with other teams and clients in a relaxed setting.

The next day was all business: the official hacking day. Each team had their own dedicated table in a room setup for us. We spent the last few hours polishing reports and submitting final findings, and just like with Canada, we clinched victory against Nepal in the final moments.

That night, HackerOne hosted an awards ceremony at a club with drinks, a live DJ, and plenty of celebration. Two of my teammates, Floerer and JackDS, were recognized for one of the best bugs of the event, a well-deserved award!

Final Four: Up against last years champions

Next was the Final Four, back to an online format. We were up against Spain, last year’s champions and a dominant force throughout the event. We gave it our all, but they proved to be the stronger team this round.

However, luckily for us, all four remaining teams were invited to the finals in Dubai, so the journey wasn’t over yet.

The grand finale in Dubai

Twelve members per team were flown into Dubai for the final event. After landing, we dove straight into bug hunting on hardened applications from our assigned targets. Even though these systems were well-secured, we still found serious vulnerabilities worth reporting.

Wednesday night and Thursday were mostly spent hacking from the hotel lobby. On Thursday evening, we attended the Security@ conference hosted by HackerOne for the local community, followed by a networking reception. It was great to connect not only with fellow participants but also with security professionals from the UAE.

Friday was the official event day. Like in Prague, we all gathered in one room to hack, submit last-minute PoCs, and polish reports. Submissions closed around 3 PM, followed by a “show & tell” session where hackers showcased their top findings. A very inspiring part of the event  where other hunting share their bugs and how they discovered it.

In the evening, we were taken to a club-style venue in the Dubai Mall near the Burj Khalifa. Here the winning teams were announced, congratulations to team Spain! We ended fourth this round, but since this was the first time our team joined the competition we can be very proud we made it this far! After the award ceremony we enjoyed a relaxed evening playing darts, sampling small dishes, and chatting with other teams about bugs and experiences, a perfect ending to an unforgettable event.

Some stats from the event

Over the course of the event, I submitted 25 reports:

• 7 marked as Informative
• 12 marked as Duplicate
• 2 were Self-closed (N/A)
• 4 were Accepted

Of the accepted reports:

• 3 were Medium severity
• 1 was High severity

The duplicate reports included:

• 5 Medium severity
• 1 Low severity
• The rest were flagged as duplicates of my own accepted submissions.

Additionally, 9 reports were submitted in collaboration with teammates.

Total bounties earned: $3,250

Reflecting on the Numbers

The nature and volume of reports I submitted during the event were quite different from my usual bug bounty hunting outside of competitions. Normally, my bounty-to-report ratio is higher, but here I ended up with several self-duplicates and a lower overall acceptance rate.

Also, I tend to focus more on high-severity bugs in my regular work, whereas during the event I submitted more medium and low-severity findings, sometimes even the kind I might not report normally.

If I’m lucky enough to be invited again in the future, I’ll aim to stay more focused on my personal strengths and try not to get too distracted by all the interesting findings being shared around me. While those conversations are valuable, they can sometimes pull you out of your own flow.

Final toughts

The HackerOne Ambassador World Cup was more than just a competition, it was a journey filled with learning, networking, and personal growth. I’m incredibly proud to have represented the Netherlands and to have worked alongside such a dedicated and talented team. Every round brought new challenges, and with each one I gained more insights, both technical and personal.

A big thank you to HackerOne, and especially Ariel, for organizing such a unique, large-scale event and making sure everything ran smoothly, both online and in person.

Thanks also to Yoeri, our Dutch Ambassador, for guiding the team and making sure we were always well organized and prepared.

To the entire Dutch team: thank you for your hard work, knowledge sharing, and for pushing each other to do our best.

Thank you to all the other national teams, not just for being fierce competitors, but for being part of such a supportive and inspiring community.

And finally, a huge congratulations to team Spain for winning the competition!