Trust · Security & Disclosure

Found something? Tell us first.

We build a tool that hunts vulnerabilities — so we hold our own surface to the same bar. If you've found a weakness in AuditHunt, here's exactly how to report it, what protection you have, and how fast we'll move.

Version2026-06-13
Report tosecurity@audithunt.com
PGP[OWNER]
Triage SLA2 business days

§ 01 · ChannelHow to report.

Email a clear, reproducible report to our security address. Include the affected URL or endpoint, the steps to reproduce, the impact you observed, and any proof-of-concept. Encrypt sensitive details with our PGP key.

Email security@audithunt.com security.txt /.well-known/security.txt

OWNER: add the published PGP key fingerprint + a bug-bounty/VDP platform link if one is used

§ 02 · SurfaceScope.

In scope: the AuditHunt web application, marketing site, public API, and authentication flows.

  • audithunt.com and app.audithunt.com
  • The public REST API and webhook delivery
  • Account, billing, payout, and affiliate flows

Out of scope: findings produced by the audit engine about your own contracts (that's the product working — submit those through a normal scan), volumetric DoS, social engineering of staff, and reports from automated scanners without a demonstrated impact.

§ 03 · ProtectionSafe harbor.

Good-faith research is welcome
If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we'll work with you to understand and resolve the issue quickly.

Good faith means: you avoid privacy violations, data destruction, and service disruption; you only interact with accounts you own or have permission to test; and you give us reasonable time to remediate before any public disclosure.

§ 04 · CadenceOur response.

When you report a valid issue, you can expect:

  • Acknowledgment within 2 business days.
  • Triage & severity assessment with you, promptly after acknowledgment.
  • Remediation timeline shared once severity is confirmed; critical issues are prioritized immediately.
  • Recognition in our hall of thanks, with your consent, once the fix ships.
OWNER: confirm whether monetary bounties are offered, and the reward tiers, before launch

§ 05 · ConductGuidelines.

  • Report as soon as you find an issue; don't stockpile or chain weaknesses for greater impact.
  • Use test accounts and the least data necessary to demonstrate the issue.
  • Never access, modify, or exfiltrate other users' data, or submitted contract source that isn't yours.
  • Keep findings confidential until we've confirmed a fix and agreed on disclosure.

§ 06 · CreditHall of thanks.

Researchers who responsibly disclose are recognized here, with their consent. The hunt is a community — and we pay our respects to the people who keep us honest.

Be the first name here
This list opens at launch. Disclose a valid issue and — if you'd like — your handle goes on the board. OWNER: populate as disclosures are resolved
Security · v2026-06-13
v3.107.0 · security