Resources
Reputation, signal and impact
Last updated
How root-me.cloud turns closed reports into a public track record. The tables below are generated from the scoring code itself, so they always match what you see on profiles and leaderboards.
On this page
1.Three numbers
Every hacker profile on root-me.cloud shows three figures, all computed from the hacker’s closed reports:
- Reputation: the total points earned. It grows with every valid finding and drops with noise.
- Signal: the average points per closed report, before severity bonuses. It measures how often your reports are valid.
- Impact: the average severity bonus per resolved report. It measures how serious your valid findings are.
The same calculation runs for every program type: a resolved report on a disclosure program earns exactly what it would on a bounty program. Rewards paid in money do not change reputation.
2.Reputation
A report earns reputation when it closes. The points depend on the state it closes in and, for resolved reports, on its final severity:
Reports that are still new, needs more info or triaged earn nothing yet. Reputation is recalculated whenever the program team changes a report’s state or severity: if a resolved report is reopened, its points are removed until it closes again.
3.Signal
Signal is the average of the points above without the severity bonus, over all of a hacker’s closed reports. It ranges from -10.00 (every report closed as spam) to 7.00 (every report resolved).
Open reports do not count. Duplicates count, but much less than resolved reports: checking a program’s Hacktivity and disclosed reports before submitting keeps your signal high.
4.Impact
Impact is the average severity bonus over a hacker’s resolved reports, from 0.00 to 25.00. Reports in other states do not count. A hacker whose resolved reports are all critical has an impact of 25.00; one who mostly finds low-severity issues sits near 3.00.
5.A worked example
A hacker has five closed reports:
- Reputation = +22 +15 +10 +2 −5 = 44
- Signal = (+7 +7 +7 +2 −5) ÷ 5 = 3.60
- Impact = (+15 +8 +3) ÷ 3 = 8.67
6.Leaderboards and Thanks pages
The leaderboard and each program’s Thanks page rank hackers with the same rules:
- Only reports closed during the period count, whatever their submission date. Periods include the last 90 days, the current quarter, the current year and all time.
- Hackers are ordered by the reputation those reports earned. Only positive totals are ranked.
- On a tie, the hacker whose first counted report was submitted earlier ranks higher.
- Signal and impact shown next to each name are computed over the same reports.
- Only reports on public programs count. A program’s Thanks page counts only the reports made to that program.
- Members of the program team, and accounts that are hidden or banned, are never ranked or thanked publicly.
On your profile
Your profile shows your rank among all ranked hackers for the selected period, and where your signal and impact stand: the share of ranked hackers whose figure is lower than yours. Percentiles appear once at least two hackers have a figure to compare.
Disagree with a closure?
Reputation follows the program team’s decision. If you think a report was closed in the wrong state, reply in the report thread with your reasoning; the team can change the state, and your reputation follows.