Frequently Asked Questions (FAQ)
Who runs SevHunt?
SevHunt is ran by Sam Mortenson, a software developer and security researcher who has worked as both a triager and bug-hunter in multiple bug bounty programs.
Can I use SevHunt if I already run an external bug bounty program?
Yes! You can think of SevHunt as just "more reports with a new scope", and since you are already doing external triage, internal work should be a breeze (ex: you're not going to get internal reporters arguing with you about payment, probably).
Can I use SevHunt if I don't have a security team?
Yes! Although, you should first make sure you have the capacity to actually triage and fix the bug reports you get. We want you to be successful, so make sure you have some individual or team who can take ownership of the program's success.
How is SevHunt built?
Amazingly in this day and age, by hand. We aren't against AI but didn't use it for development* of the product, which we think has led to a more stable initial launch.
If you didn't mean this in a "Is this vibe coded?" way: SevHunt is a React single page app that uses NodeJS on the backend.
* We perform code security audits with AI, but remediate findings ourselves
How do you keep my data secure?
SevHunt uses client side encryption for everything involved in the reporting flow: titles, summaries, replication steps, replies, and even file uploads.
This means that a data breach at SevHunt, a bug in our authorization code, or a problem on your side cannot (trivially) result in exfiltration of your reports in plaintext.
SevHunt's report encryption is mostly about protecting us, not you. The best way to ensure your privacy is to make your (report) data unusable to us.
Note: Only report data is encrypted to allow employees on your side to visit SevHunt without having to learn what a public key is. If you have thousands of employees you probably don't want to manage shared encryption secrets anyway.
How do I contact you?
Please email me at sam+contact@snippetsolver.com with any questions you have!