Disclaimer: This report reflects the submitter's account. It has not been independently verified unless marked Verified. The company may dispute this claim.
Scam Alert: huntr.com — huntr validated bounties retroactively reduced, then withheld after account ban
Company / Program: huntr.com
Platform: Other · Severity: critical · Scam type: no-payout
Published:
Reported by: Linziyu
I'm a security researcher who submitted 70+ vulnerability reports to huntr, all validated by huntr's team. I also wrote and merged the fixes myself in the affected open-source projects (nltk, keras, transformers, airflow), and many reports received CVEs.
What happened with payment:
1. Retroactive reduction. My June bounties were validated at a total of $41,375. This was then retroactively reduced to $18,070, which huntr attributed to a "system bug." Reports of the same severity had been paid at the original rates the previous month and were never clawed back.
2. Partial payment after repeated delays. Payment was committed to multiple times over several weeks ("last week," then a specific date, then "within 24 hours" once funds reportedly reached Stripe). Ultimately only $14,080 was paid.
3. Ban and withheld payment after I asked about the remaining bounties. After part of the June payout arrived, I asked huntr how the remaining balance and my July bounties would be paid. Following that, my account was reviewed and then permanently banned, citing a broad "bad faith use" clause (section 5.6 of the Participation Terms), and huntr refused to pay the remaining bounties. These were reports huntr's own team had already validated, and some had already been paid. In other words, the breach objection was raised only after I asked how I would receive the money I was owed. I do not consider this reasonable: bounties that had already been validated and confirmed were withheld under a broad clause, with the objection surfacing only at the point of payment.