Acceptance of terms
By creating an account or submitting a report on HuntBug, you agree to these Terms, our Responsible Disclosure Policy, and each program's individual policy at the time of submission. Where a program policy conflicts with these Terms, these Terms win.
Accounts & eligibility
You must be 16 or older to hold a researcher account, and 18 or older to receive payouts. One account per person; reputation is personal and non-transferable.
Identity verification is required before your first payout. We screen against applicable sanctions lists and cannot pay researchers in embargoed jurisdictions.
Researcher conduct
You agree to test only in-scope assets, respect program rate limits, and report findings promptly through the platform. Findings must be your own work; AI-assisted tooling is fine, fabricated or unverified AI-generated reports are not — three fabricated reports is a permanent ban.
- Report a vulnerability as soon as you can demonstrate impact.
- Do not access, modify, or retain data beyond the minimum needed as evidence.
- Do not disclose findings publicly before the coordinated disclosure window closes.
Program terms
Companies running programs agree to fund an escrow balance covering their published bounty table, to respond within the SLA tier they advertise, and not to use reported findings against the reporting researcher.
Severity is locked at triage acceptance. A program may raise severity after acceptance (with the payout raised to match) but may never lower it.
Bounties & payments
Bounty amounts are set by each program's published table, keyed to severity at triage acceptance. Payment releases from escrow when the fix ships or 90 days after acceptance, whichever comes first.
Available payout rails: bank wire, Wise, and USDC. HuntBug issues 1099 forms to US researchers and collects W-8BEN from non-US researchers. Our platform fee is charged to programs, never deducted from researcher bounties.
Duplicates: the earliest complete submission wins. A later report that materially expands impact earns partial credit at triage's discretion, between 10% and 50% of the original award.
Confidentiality & disclosure
Report contents are confidential between you, the program, and HuntBug triage until the disclosure window closes. After the window, you may publish your report with its final severity and payout unless the program purchased a non-disclosure add-on before your submission — programs cannot buy silence retroactively.
Prohibited activities
The following void safe harbor and result in immediate account action: social engineering of program staff or users; physical intrusion attempts; denial-of-service testing; data exfiltration beyond minimal evidence; testing third parties not named in scope; and conditioning any report on payment outside the platform.
Intellectual property
You own your reports. You grant the program a license to use your report to remediate the finding, and you grant HuntBug a limited license to process, store, and display it within the platform. Your handle, rank, and public stats may appear on leaderboards and the Hall of Fame; you can opt out of public display in settings.
Termination
You may close your account at any time; accrued bounties remain payable. We may suspend accounts for policy violations, with notice and a stated reason. Permanent bans are reviewed by a human, appealable once, within 30 days.
Limitation of liability
The platform is provided "as is." To the maximum extent permitted by law, HuntBug's aggregate liability to you is limited to the greater of $1,000 or the amounts paid to you (for researchers) or paid by you (for programs) in the 12 months preceding the claim.
Governing law
These Terms are governed by the laws of the State of Delaware, USA, excluding its conflict-of-law rules. Disputes go first to good-faith mediation, then to binding arbitration in Wilmington, Delaware — except researchers may always bring claims in their local small-claims court.
Changes to these terms
We give 30 days' notice of material changes by email and platform banner. Continued use after the effective date constitutes acceptance.