When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge.

from Stack Overflow Badge Feedback - Blog - Stack Overflow

I’m specifically referring to the secret Stack Overflow hacker badge. It does exist, though it has yet to be awarded. (There might even be some other secret badges out there.. who knows?)

It’s just taking a while to get around to implementing it*, as it doesn’t behave like any other badge; it’s a manually maintained key-value pair of users who have “contributed to Stack Overflow in an unusual way.” Typically this means you’ve found a serious security exploit and sent it to us privately rather than making it public or exploiting it and harming the site. But that’s not the only way to earn it!

* more than our usual 6-8 weeks.

from No, We Have Not Forgotten About the Hacker Badge - Blog - Stack Oveflow

It apparently even existed in the database at one point:

<Description>Contributed to Stack Overflow in an unusual way</Description>

In the end the Hacker badge was developed into a joke instead of a feature, but it was a good idea. Particularly if a potential hacker is already a user, this may be all it would take to motivate them1 to report bugs responsibly instead of having a laugh at the site's expense.

May I just add that the concept of the Hacker badge (if implemented as the anonymous emailer suggested) is one of the best security Hacks ever. Find something of little value you can give people to get them to attempt to hack your site and admit it.

from a comment by Bill K on I Just Logged in as You - Coding Horror

Badges are supposed to encourage positive behaviour. This seems like a good fit. It should be implemented in some capacity.

1 In order to continue to motivate users who have previously earned it, it should probably be awardable multiple times.

  • 14
    Public knowledge of this kind of badge would get people like me more interested in diving into page sources and looking for vulnerabilities in my spare time. I think it's a great way to leverage the resources (userbase) SO has available to it.
    – user172164
    Feb 17, 2012 at 4:41
  • 16
    I realize it is necessary for the context of your feature request, but please don't confuse cracker with hacker. Real hackers don't like that :)
    – Tim Post
    Feb 17, 2012 at 13:14
  • @TimPost if only 1% of the people would know the difference (i.e. would even know such word "cracker" exists), the world would be a better place. :) Jul 15, 2018 at 12:44

3 Answers 3


I'm against any badge awarded manually as subjectiveness gets in the way.. I think awarding them automatically was a great idea and let's stick to that.

  • 14
    A security vulnerability is a security vulnerability. No subjectiveness there. Feb 21, 2014 at 8:00
  • 5
    After seeing some of the drama around the "Eureka" winterbash hat -- and that was only a hat, that goes away in a few weeks -- I'm inclined to agree. Don't put people in the position of having to decide what counts; it invites way more drama than benefit. Jun 7, 2015 at 4:26
  • 9
    Actually, a "security vulnerability" is very subjective Jun 7, 2015 at 12:07
  • 1
    @MonicaCellio I got the Eureka hat because my friend told me what the Eureka hat did.
    – Cilan
    Sep 5, 2015 at 14:53
  • 1
    How is a security vulnerability subjective? Perhaps you're thinking of "severity"?
    – James
    Jul 14, 2018 at 19:03

Any way to get people to spend more time looking for security vulnerabilities and disclosure them responsibly is an obvious win. Not just for the Stack Exchange network admins, but for everyone using the site.


This is not behavior we should be encouraging. The awesome software and network engineers at Stack Exchange are sufficient to the task, and we shouldn't encourage another thousand or million people to perform random attacks on the site in the hopes of exposing a weakness.

Further, who gets to wade through all the "lol, I used a userscript to change the logo, gimme the hacker badge" and "Hey, I found that if I send thousands of requests a second the server stops responding, gimme a hacker badge" messages?

Lastly, while being proactive about exploits is generally a good thing, it's possible that there are hundreds or thousands of tiny little things that could be better, and verifying a given problem, and fixing it takes resources that are better spent on features that will positively impact the site. Yes, we can fix that last 1%, but it's going to take months of man hours for work that ultimately isn't going to improve the site as much as putting that same effort to work on other features.

  • 10
    “The awesome software and network engineers at Stack Exchange are sufficient to the task” Nobody’s perfect. Google, Microsoft, Facebook, GitHub etc. employ some very smart people too, yet still it’s beneficial for them to run a bug bounty program. Feb 21, 2014 at 8:03
  • 3
    “while being proactive about exploits is generally a good thing […] fixing it takes resources that are better spent on features that will positively impact the site” — you don’t think making the Stack Exchange network more secure has a positive impact? Feb 21, 2014 at 8:05
  • 1
    There has to be a balance between security and ongoing development. If the site were in poor hands, I would worry about security more. Given that the developers are aware of security risks and develop in a way to reduce exploit possibilities, though, then there is little reason to encourage hundreds of people to actively attack the site in an effort to obtain a badge. As far as security, the site contains little valuable information that it doesn't already give out. It's not a high value target. It doesn't need the same security one might use for credit card processing.
    – Pollyanna
    Feb 21, 2014 at 17:44
  • 3
    Ooh! Look at me! Winterbash is over, but I still have a hat on! Give me the hacker badge!
    – neminem
    Feb 25, 2014 at 17:24
  • 1
    @AdamDavis Stack Overflow Careers is at least a bit more sensitive: it knows users' addresses, phone numbers, and real names. It's also used to manage paid ad campaigns.
    – Jeremy
    Feb 26, 2014 at 6:37
  • 2
    @neminem If you found a way to keep a real Winterbash hat after the event, you'd deserve the badge.
    – Jeremy
    Feb 26, 2014 at 6:38
  • 1
    @JeremyBanks It's totally a real Winterbash hat. I mean, look at it, doesn't that look just like a Winterbash hat? :p (Spoiler: it's not actually a real Winterbash hat.)
    – neminem
    Feb 26, 2014 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .