Vulnerability Disclosure Policy

Effective Date: June 29, 2026

1.Introduction

Hunter Strategy is committed to ensuring the security of our systems and protecting our clients’ data. We value the security research community and encourage responsible disclosure of security vulnerabilities. This policy outlines our commitment to working with security researchers and provides guidelines for reporting potential security issues.

2.Scope

In-Scope Systems and Assets

Security researchers are authorized to test the following Hunter Strategy-owned systems:

Primary Domains

hunterstrategy.net and all subdomains

Web Applications

Public-facing web applications and portals
Client-facing interfaces (excluding client data/environments)
API endpoints documented in public documentation

Infrastructure

Public-facing network infrastructure
Email systems (limited to configuration testing, not content access)

Out-of-Scope Systems and Assets

The following are explicitly out of scope and should not be tested:

Client Environments: Any systems, networks, or data belonging to Hunter Strategy clients.
Third-Party Services: Systems hosted or managed by third-party vendors (AWS, Microsoft 365, etc.).
Physical Security: Physical offices, data centers, or facilities.
Employee Systems: Personal devices or accounts of Hunter Strategy employees.
Non-Production Systems: Development, staging, or testing environments not explicitly listed as in-scope.

3.Out-of-Scope Vulnerabilities

The following issues are considered out of scope and typically will not qualify for acknowledgment:

Low-Impact Issues

Missing security headers that don't lead to exploitable vulnerabilities
SSL/TLS best practices without demonstrated security impact
Descriptive error messages without sensitive data exposure
Presence of banner information or software version disclosure alone

Social Engineering

Phishing attacks against Hunter Strategy employees
Physical social engineering attempts
Vishing (voice phishing) or SMS phishing

Denial of Service

DoS or DDoS attacks
Resource exhaustion attacks
Spam or flooding attacks

Generic Vulnerabilities

Issues in third-party applications without demonstrated impact on Hunter Strategy systems
Theoretical vulnerabilities without proof of concept
Vulnerabilities requiring unlikely user interaction
Issues already publicly disclosed and awaiting vendor patches

Non-Security Issues

SPF/DKIM/DMARC configuration issues without demonstrated exploit path
UI/UX issues or feature requests
Issues requiring physical access to user devices

4.Safe Harbor

Hunter Strategy supports good-faith security research and will not pursue legal action against researchers who:

Make good faith efforts to comply with this policy
Act in good faith to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data
Do not exploit a security vulnerability beyond the minimal amount necessary to confirm its existence
Do not access, modify, or delete Hunter Strategy data or client data
Report vulnerabilities promptly through our official channels
Keep vulnerability details confidential until Hunter Strategy has had reasonable time to address the issue

Legal Safe Harbor Provisions

When conducting security research according to this policy:

We will not initiate legal action for activities conducted in compliance with this policy
We will not file a complaint with law enforcement for activities conducted in compliance with this policy
If legal action is initiated by a third party against you for activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy

Important Note: This safe harbor applies only to activities explicitly authorized by this policy. We cannot authorize testing of third-party systems or client environments.

5.Testing Guidelines

Authorized Testing Methods

Researchers may use the following methods when testing in-scope systems:

Automated and manual scanning for vulnerabilities
Proof-of-concept demonstrations (non-destructive only)
Authentication and authorization testing
Input validation and injection testing
Configuration and deployment testing

Prohibited Testing Activities

The following activities are strictly prohibited:

Destructive Testing

Modifying or deleting data
Disrupting services or degrading system performance
Executing denial of service attacks
Deploying malware, ransomware, or cryptocurrency miners

Data Access

Accessing, downloading, or exfiltrating sensitive data
Pivoting to other systems or networks
Accessing other users' accounts or data (beyond your own test accounts)
Social engineering attacks against Hunter Strategy employees or clients

Excessive Testing

High-volume automated scanning that impacts system performance
Repeated testing of the same vulnerability after initial confirmation
Testing that generates excessive logs or alerts

Researcher Responsibilities

When conducting security research:

Use your own test accounts when possible; do not access other users' accounts
Minimize the amount of data accessed to validate the vulnerability
Do not publicly disclose vulnerability details before we've had time to remediate
Do not demand compensation or threaten public disclosure
Provide detailed, accurate reports with clear reproduction steps

6.Reporting Process

How to Report a Vulnerability

Please report security vulnerabilities through one of the following channels:

Primary Method - Web Form

https://hunterstrategy.net/vulnerability-reporting

Alternative Method - Email

security@hunterstrategy.net

Information to Include

To help us triage and address your report quickly, please include:

Vulnerability Description

Type of vulnerability (e.g., SQL injection, XSS, authentication bypass)
Affected system(s) or URL(s)
Your assessment of severity and potential impact

Reproduction Steps

Detailed step-by-step instructions to reproduce the issue
Any specific configuration or preconditions required
Screenshots, videos, or proof-of-concept code (if applicable)

Impact Assessment

Potential security impact if exploited
Any data accessed during testing (type and minimal scope only)
Affected user base or business functions

Your Information (Optional)

Name or handle (if you wish to be acknowledged)
Contact email for follow-up questions
Any affiliation or organization

7.Our Response Process

Acknowledgment

Initial Response: We will acknowledge receipt of your report within 2 business days
Confirmation: We will confirm whether we can reproduce the issue within 5 business days
Updates: We will provide status updates at least every 14 days until resolution

Severity Assessment

We assess vulnerabilities using a risk-based approach considering:

Critical: Immediate threat to system integrity, client data, or business operations
High: Significant security impact requiring urgent attention
Medium: Moderate security impact with limited exploitability
Low: Minimal security impact or requires significant preconditions

Remediation Timeline

Our target remediation timelines by severity:

Critical: 7 days
High: 30 days
Medium: 90 days
Low: 180 days or next scheduled maintenance window

Note: These are target timelines. Complex vulnerabilities may require additional time, and we will communicate updated timelines as needed.

Coordinated Disclosure

We follow a 90-day coordinated disclosure timeline:

We request that researchers keep vulnerability details confidential for 90 days after initial report
We will work to remediate the issue within this timeframe
After remediation is complete, or 90 days have elapsed (whichever comes first), researchers are free to publish details
If we need additional time, we will communicate this and work with the researcher on an extended timeline

8.Recognition and Acknowledgment

Public Acknowledgment

With your permission, we will:

List your name or handle on our Security Researchers Hall of Fame (once established)
Publicly thank you for your contribution to our security posture
Provide details of the vulnerability type (after remediation)

Note: We will always request permission before publishing any information about you or your research.

What We Don't Offer

Hunter Strategy does not currently offer:

Monetary bug bounties or rewards
Swag or physical rewards
Compensation for research time

We deeply appreciate the security research community's contributions and recognize researchers through public acknowledgment.

9.Questions and Clarifications

If you have questions about:

Whether a system is in scope
Appropriate testing methods
This policy in general

Please contact us at security@hunterstrategy.net before conducting testing.

10.Changes to This Policy

We may update this policy periodically. Changes will be posted at this URL with an updated "Last Updated" date. We encourage researchers to review this policy before conducting security research.

Current Version: 1.0
Policy Location: https://hunterstrategy.net/vulnerability-disclosure

If you have questions about this Vulnerability Disclosure Policy, please contact us:

Security Team:

security@hunterstrategy.net