We welcome reports of security problems in Hunt from researchers and users. This policy explains how to report a vulnerability, what is in scope, and the promises we make to people who report in good faith.
How to report
Email hello@huntbrowser.com. Please include:
- what the problem is and what someone could do with it;
- the product, version and platform, or the web address;
- clear steps to reproduce it, with screenshots, a short video or proof-of-concept code if you have them;
- your name or handle, if you would like to be credited.
Please write in English if you can. Don't include other people's personal data in your report.
What we promise
- We will acknowledge your report within 3 working days.
- We will tell you whether we can reproduce it, and keep you updated while we fix it.
- We aim to fix serious problems as quickly as we can, and to agree with you a date for publishing details, normally within 90 days of your report.
- If you would like, we will credit you when we publish the fix.
We do not run a paid bug bounty at the moment.
In scope
- Hunt Browser for Windows, Mac, Android, iPhone and iPad, including Hunt's own changes to Chromium and the Hunt Updater;
- the Hunt extension for Chrome and Edge;
- huntbrowser.com and www.huntbrowser.com, including sign-in;
- api.huntbrowser.com and the services behind it, such as Rewards, Sync, AI and settings;
- the advertiser portal at ads.huntbrowser.com.
We are especially interested in problems that could expose users' personal data, let someone sign in as another user, read Sync data, change points balances, bypass fraud checks, forge update packages or settings, or run code on a user's device.
Out of scope
- Bugs in Chromium or WebKit that are not caused by Hunt's changes. Please report those to the Chromium project or to Apple, and let us know so we can ship the fix.
- Services run by our partners, such as offer partners, shops and publishers. Report those to the partner.
- Denial-of-service attacks, load testing or spam.
- Social engineering, phishing or physical attacks on our staff or offices.
- Reports from automated scanners without a working example of real impact.
- Missing best-practice headers or settings with no demonstrated security impact.
- Problems that need a device that is already compromised, rooted or jailbroken.
- Earning points in ways the Rewards rules forbid. Tell us about the weakness instead of using it.
Safe harbour
If you act in good faith and follow this policy, we will:
- treat your research as authorised, and not take legal action against you or report you to the police for it;
- work with you to understand and fix the problem quickly;
- not ask your internet provider to act against you for it.
To stay within this policy, you must:
- only test against your own accounts, or accounts you have permission to use;
- stop as soon as you reach personal data that is not yours, not keep or share it, and tell us;
- not damage, change or delete data, or disrupt our services for other users;
- not use a weakness to earn, move or redeem points;
- give us reasonable time to fix the problem before telling anyone else;
- follow the law.
This safe harbour covers our own claims only. We cannot authorise testing against third parties' systems, and it does not override the law. If you are unsure whether something is allowed, ask us first.
Contact
hello@huntbrowser.com. To report a suspicious message that pretends to be from Hunt, see our Communications Policy.