HackerOne

Unofficial Obsidian HackerOne plugin

Import your HackerOne reports and earnings into an Obsidian vault. Requires Obsidian 1.6.6 or newer and the Dataview plugin to render the summaries. The minimum version provides the public file-manager API used to respect your trash preference during recovery from a failed folder move.

Install the plugin, enter your HackerOne username and API token in its settings, then run HackerOne: Fetch reports from the command palette.

A HackerOne account and API token are required. The plugin connects to https://api.hackerone.com to retrieve your reports and earnings and stores the imported notes in your vault. It does not collect telemetry or access files outside the vault.

Enable Dataview under Settings → Community plugins to display the summaries. If it is missing or disabled, HackerOne warns once per plugin session and continues importing reports. This check uses Obsidian's internal plugin registry; if the registry is unavailable, imports continue without a Dataview status warning.

Syncing

Once credentials are set, a sync runs at startup and then every 10 minutes. The interval is configurable from 1 to 1440 minutes; 0 disables periodic sync, leaving the startup sync and the command. Only one sync runs at a time, and a folder move waits for the one in flight.

Automatic syncs are quiet: they report a failure once and stay silent until a different error occurs or a sync succeeds. A sync you asked for always answers, with a count of the notes created, updated, unchanged and failed.

Notes and summaries

Reports live in <directory>/reports. The report description is imported only when the note is created. Later syncs update the HackerOne frontmatter properties and nothing else, so your Markdown body and your own properties survive every sync.

HackerOne owns the imported API attributes plus Type, title, url, bounty, severity, program and platform. Keep Type and url: they are how a note you renamed is still recognized. A note whose YAML header cannot be parsed is reported and left untouched for you to repair, and while a note in the folder cannot be read at all, no new notes are created — that is what stops a rename from turning into a duplicate.

bounty is the sum of the report's bounties, bonuses and completed retests, in whole currency units with cents.

The two generated summaries query only the configured reports folder. In the current-year summary the report list filters on created_at while both money tables filter on bounty_awarded_at, so the two totals agree with each other. Those totals sum each matching report's cumulative bounty; they are not a ledger of the payments received during that year. The year itself is resolved by Dataview, so the summary stays correct when the year turns.

Known, unmodified summary templates are regenerated in place, including the older ones that had the year written into them. A summary you customized, even if it retains the plugin marker, is copied to a free .md.backup (or .md.backup-N) name before being regenerated. Unknown historical layouts are also backed up conservatively. These two files are plugin-managed, so keep your own dashboards in separate files.

Changing the folder

Type the new path and click Apply. The imported notes and the two summaries move through Obsidian's file manager, so your annotations come with them and links are updated according to your link-update preference. Unrelated files and existing backups stay where they are. The move is planned before anything is written: a collision, or a destination that already holds a note for the same report, aborts it with nothing moved. A destination inside the current folder, or containing it, is refused. If a move fails part-way it restores the original locations, and if a restore itself fails it names the files that need your attention.

API token storage

The token field is masked, but the token is stored unencrypted in .obsidian/plugins/hackerone/data.json inside your vault. Masking the input does not encrypt that file. Obsidian Sync, other sync services and backups may copy plugin settings depending on your configuration, so exclude that file from Git and from shared backups, and consider which devices and accounts can read your vault. If a token has been committed or shared, revoke it in HackerOne and create a new one: adding an ignore rule does not remove it from Git history.

Errors shown by the plugin redact the token and the Basic authorization header.

Development

Node.js 24 and the committed lockfile:

npm ci
npm run lint
npm test
npm run build

Tests run on Node's test runner against an esbuild bundle in which the obsidian import is aliased to an in-memory double, so vault and network behaviour is exercised without Obsidian. That double is not Obsidian: before a release, also check startup, the settings tab, a folder move and the Dataview rendering in a scratch vault — never in a vault holding notes you care about, since the plugin moves folders and regenerates the summaries.

Keep the package.json, package-lock.json and manifest.json versions in step and record each release's minimum Obsidian version in versions.json. Pushing a tag matching the manifest version creates a draft release. Publish that draft after CI passes so the update can be downloaded from Obsidian.