Understanding Node.js' New Signal Requirement for Security Reports

"This decision addresses a critical operational need. While Node.js values open collaboration, the volume of low-quality security reports has increased drastically, driven largely by automated tools and generative AI. The problem: Between December and January, the project received over 30 vulnerability reports, compared to the usual average of 6 or 7 per month. Many of these submissions lacked technical merit or turned out to be false positives."

"Signal is a reputation metric that reflects the historical validity of a researcher's vulnerability reports. How it works: Signal is calculated as the average reputation per report. When a researcher submits valid, actionable findings, their Signal score increases. When reports are marked as spam or not applicable, the score decreases. The new standard: Node.js now requires a Signal score of 1.0 or higher. This acts as a statistical filter, prioritizing reports from researchers with a proven track record of accuracy and reducing low-signal submissions."

Node.js requires a minimum HackerOne Signal score of 1.0 to filter low-quality vulnerability reports and reduce maintainers' triage burden. Automated tools and generative AI caused a surge in superficial or false-positive reports, with over 30 submissions received between December and January versus a typical 6–7 per month. Signal measures a researcher's average reputation per report, rising with valid, actionable findings and falling with spam or inapplicable submissions. The policy uses Signal as a statistical filter to prioritize proven reporters while preserving a two-tiered process that maintains an entry path for new contributors and supports sustainable security operations.

Read at The NodeSource Blog - Node.js Tutorials, Guides, and Updates