The Rules of Engagement govern what you do to systems. This governs how you conduct yourself as a member of this platform.
1Honesty in your work
1.1You report what you found, not what you think would be impressive. A finding is described at the severity you can evidence.
1.2You do not manufacture, inflate or stage a finding, including by creating the condition you then report.
1.3You state your confidence honestly. "I reproduced this once and cannot reproduce it reliably" is a useful thing to tell the desk and an acceptable thing to submit. Presenting it as confirmed is not.
1.4Where you are uncertain, you say so. Where you were wrong, you say so. A withdrawn finding costs the desk an hour; an unwithdrawn wrong one costs the client a remediation programme.
1.5You do not submit another person's work as your own, and you do not submit the same finding twice under different framing.
2Honesty about yourself
2.1The identity, jurisdiction, experience and credentials on your application are ones you can substantiate. HUNT verifies, and a false statement is a removal.
2.2You hold one account. You do not operate through another person's account or let anyone operate through yours.
2.3You disclose a conflict of interest before accepting a mission, including where you have worked for the client, hold a position that would benefit from the finding, or have a relationship with anyone involved in the engagement.
3Conduct towards others
3.1You treat clients, HUNT staff and other operators with professional courtesy, including when you disagree with a triage decision, a severity call, or a payout.
3.2You do not harass, threaten, demean or discriminate against anyone. This covers the mission thread, support channels, and any forum where you are identifiable as a HUNT operator.
3.3You do not pressure a client (through the thread, through disclosure threats, or through any public channel) into a payment, a severity, or an outcome. Escalation is through the desk, always.
3.4You do not contact a client outside the platform about platform work.
4Confidentiality of the field
4.1You do not disclose the identity of other operators, the composition of houses, mission assignments, or who is working on what.
4.2You do not disclose a client's identity or their relationship with HUNT.
4.3What you learn about the platform's own operation (review criteria, tooling, internal process) stays inside it.
5Independence and the law
5.1You are responsible for operating lawfully in your own jurisdiction and in the jurisdiction of the target. HUNT's authorisation from a client is not a defence to a law that prohibits the activity where you are.
5.2You do not accept work through HUNT that you are barred from performing by a contract, an employer, a court order, or a sanctions regime.
5.3You are an independent operator, not an employee of HUNT, unless a separate written agreement says otherwise.
6Responsibility for your own security
6.1You protect your account: a second factor enrolled, credentials not shared or reused, sessions ended on shared machines.
6.2You protect mission material on your own systems: encrypted at rest, deleted when the engagement ends, never on a machine or service you do not control.
6.3If your account, your device or mission material is compromised, you tell HUNT immediately. The same principle as an outage applies: immediate honesty is handled, concealment is not.
7When you disagree
7.1Raise it with the desk through the mission thread or a support ticket. Disputes have a process and it is available to you.
7.2Nothing in this code prevents you from reporting unlawful conduct (by a client, by another operator, or by HUNT) to a regulator or to law enforcement. It asks only that you do not use the threat of doing so as leverage.
This document describes how the HUNT platform operates and is binding on the platform as an operational policy. It has not been reviewed by counsel for any particular jurisdiction. HUNT will publish a counsel-reviewed version, and you will be asked to accept it, before it is relied on in any legal proceeding.