Safe harbor, guaranteed.
Security research conducted in accordance with this policy is authorized under the Computer Fraud and Abuse Act and equivalent laws in your jurisdiction. We will not initiate legal action against you, and we will state plainly to any third party that your research was authorized. If a program on HuntBug attempts to pursue a good-faith researcher, we terminate the program.
One door, always open
All reports go through the platform — never email, never DMs. Submissions are encrypted at rest, timestamped for priority, and hashed for duplicate detection. If HuntBug itself is the target, use the huntbug-core program.
The scope page is law
Each program's scope page lists in-scope assets, out-of-scope assets, and excluded vulnerability classes. Scope changes are versioned and take effect on publish — a finding made in scope stays in scope for reports filed within 72 hours of the change.
Touch the minimum
Access only what's needed to demonstrate impact. If you encounter personal data, stop, capture the minimum evidence, and report immediately. Never exfiltrate, store, or share user data — one redacted record proves the point.
Coordinated, not silent
Default disclosure window is 90 days from triage acceptance, extendable once by 30 days with written rationale. After the window, you may publish with the program's severity rating and payout attached.
Response clocks we're held to
Do this, never that
+Always fine
- Test with your own accounts — create as many as scope allows.
- Chain findings to demonstrate realistic impact.
- Use automation within each program's published rate limits.
- Report suspected duplicates — the earlier timestamp wins, partial credit applies.
- Ask triage before going deeper on anything ambiguous.
×Instant policy violation
- Social engineering — phishing, vishing, or pretexting staff or users.
- Physical access attempts against offices or data centers.
- Denial of service, resource exhaustion, or destructive payloads.
- Pivoting to third parties not named in scope.
- Extortion framing — conditioning a report on payment voids safe harbor immediately.
If the platform itself is down
Found something right now? Median time from submission to first human response: 1h 47m.