Security Disclosure Policy

How to responsibly report security vulnerabilities to Huntbase.

Last updated

1. Our Commitment

At Huntbase, security is foundational to everything we build. We recognise that independent security researchers play a valuable role in keeping platforms like ours safe, and we welcome good-faith reports of vulnerabilities in our systems.

This policy sets out how to report a security issue to us, what you can expect from us in return, and the boundaries of responsible disclosure as they apply to Huntbase.

2. Scope

This policy covers vulnerabilities in Huntbase-owned and operated systems, including:

  • The Huntbase web application and platform (app.huntbase.io and related subdomains)
  • The Huntbase marketing website (huntbase.io)
  • The Huntbase API and Scout AI interfaces
  • Huntbase-published browser extensions and CLI tools
  • Authentication flows managed by Huntbase

Out of Scope

  • Third-party services we use (PropelAuth, Cloudflare, Stripe, etc.) — please report these directly to the relevant vendor
  • Huntbase's internal tooling or corporate infrastructure
  • Social engineering or physical security attacks
  • Denial of service (DoS/DDoS) testing
  • Automated scanning without prior coordination

If you are unsure whether something is in scope, please contact us at [email protected] before proceeding.

3. How to Report

Send your report to [email protected]. Please include:

  • A description of the vulnerability and its potential impact
  • The affected system, URL, or component
  • Steps to reproduce the issue
  • Any supporting evidence such as screenshots, request/response logs, or proof-of-concept code

The more detail you provide, the faster we can triage and respond. For urgent critical vulnerabilities, please mark your subject line: [CRITICAL] Security Disclosure

4. What We Ask of You

  • Act in good faith — research should be aimed at identifying and reporting vulnerabilities, not exploiting them
  • Avoid harm — do not access, modify, or exfiltrate data beyond what is minimally necessary to demonstrate the issue
  • Do not disrupt the service — avoid actions that could degrade platform availability for other users
  • Use only accounts you own — do not test against other users' accounts or data
  • Keep it confidential — do not publicly disclose the vulnerability until we have had a reasonable opportunity to remediate it

We appreciate that security research takes time and skill, and we aim to work with researchers constructively.

5. What You Can Expect From Us

  • We will acknowledge your report within 5 business days
  • We will provide a triage assessment and status update within 30 days
  • We will notify you when the issue has been resolved
  • We will work with you to agree a disclosure timeline once remediation is complete

We default to a 90-day coordinated disclosure window from the date of your report. If we need more time due to complexity, we will explain why and seek your agreement. If we fail to respond within the timeframes above, you are free to disclose after giving us reasonable additional notice.

We will never take legal action against researchers who act in good faith and within the scope of this policy.

6. Recognition

We do not currently operate a paid bug bounty programme, but we genuinely value researcher contributions. Where a report leads to a meaningful fix, we will acknowledge your contribution publicly (with your permission) and discuss any further recognition on a case-by-case basis. We intend to formalise a bug bounty programme as Huntbase grows.

7. Legal Safe Harbour

Huntbase will not pursue civil or criminal action against researchers who discover and report vulnerabilities in good faith, in accordance with this policy, and who avoid accessing data beyond what is necessary to demonstrate the issue.

This safe harbour applies to Huntbase's own legal actions. We cannot bind the actions of third parties or law enforcement, but we will not refer researchers to authorities where they have acted within these guidelines.

8. Contact