Security policy

Last updated 2026-10-29

We build a tool for security testers, so we take reports about our own security seriously. If you find a vulnerability, email security@huntproxy.com — we'll work with you to fix it.

In scope

• This website — huntproxy.com and www.huntproxy.com.
• The license and workspace server — api.huntproxy.com.
• The Hunt Proxy desktop application, including license checks and team workspace encryption.

What to send

• What the issue is and where it is (URL, endpoint or part of the app).
• Steps to reproduce it, and what an attacker could do with it.
• Your name or handle, if you'd like credit.

What we ask of you

• Test only against your own account, keys and data. Don't access, change or delete anyone else's.
• No denial-of-service, spam, social engineering or physical attacks.
• Keep it confidential: don't share or publish the vulnerability, or details of it, until we've confirmed to you that it's fixed.

What you can expect

• A reply within a few working days.
• Updates while we fix it, and credit when it's fixed if you'd like.
• We won't take legal action against research done in good faith under this policy.

Rewards

We don't pay cash bounties. For a valid report, we may reward you with a free Hunt Proxy license for a period that depends on how serious the vulnerability is. Rewards are at our sole discretion and not guaranteed — a report may get no reward, for example if it's already known, out of scope, low impact, or found by breaking the rules above.

Not a vulnerability in Hunt Proxy?

To report Hunt Proxy being used against systems without permission, email abuse@huntproxy.com. For anything else, support@huntproxy.com.