Publication & Disclosure

Hunt operates under coordinated disclosure. Following these rules protects users, keeps programs on the platform, and keeps your findings eligible.

#The core rule

Do not publicly disclose any report until the bug is fixed and the project confirms. Exploit and PoC code may only be shared after the fix. Each program may define its own publication, embargo, or coordination requirements on top of this baseline — review the program's responsible-publication policy before disclosing anything.

#What you can always share

Even during an embargo, and without revealing any vulnerability details, you may always say:

• That you're a researcher on CertiK Hunt.
• Your aggregate earnings.
• That you earned "$X from a CertiK Hunt program" — without naming the program or the finding.

A one-click, opt-in way to share a win is available in the product once a finding reaches a state where disclosure is permitted. It only ever uses non-sensitive content — never exploit details.

#What you cannot publish

• Details of an unresolved vulnerability.
• Confidential project information.
• Anything that could reasonably increase risk to users or a project's ecosystem.
• A report that was a duplicate or known issue, or one closed by CertiK.

#When publication becomes allowed

Subject to each program's policy, publication is generally permitted once a report is resolved — for example, when it was closed as out-of-scope or no-fix, when a dispute concludes without the project accepting, or after an extended period with no resolution following escalation. For a fixed and paid report, expect a short project review/notice window before publication.

#No public exploitation

This is a hard rule: no mainnet or public-testnet exploitation, ever. Proof of concept must run on a local fork only. Exploiting a live system — or any action causing user harm — is a serious violation and grounds for a permanent ban and forfeiture of pending bounties. See Rules of Conduct.