GitHunt is the bug bounty layer for the open-source / crypto-dev world. Researchers seal vulnerabilities to repo owners in their browser. Owners fund bounties in escrow. Shipping the fix releases the payout. Reputation accrues on-chain.
::: the pact
If a feature can't be built without breaking one of these, it doesn't get built. The architecture inherits the rules.
There is no public feed of unresolved reports. Optional sanitized advisories may be published only after a fix, only with the owner's explicit consent.
Reports are end-to-end encrypted client-side to the repo owner's public key. The server holds ciphertext + metadata. The operator cannot read a reported secret.
Verification is the owner's job. Using a leaked key — even to confirm it — is exactly the line we don't cross.
Reports are private by construction; the bounty + escrow is the alternative. Pay-or-leak behavior is bond-slashable and reputation-zeroed.
::: how it works
The product is the loop. Submit, triage, release. Each move emits an event the next move trusts.
The report is sealed to the program's libsodium public key before it leaves the device. The hash of the plaintext is committed alongside.
$ sealString(plaintext,
program.encryptionPub)
→ ciphertext_b64
The repo owner decrypts in their browser using a wallet-derived keypair. State transitions are appended to an audit trail. SLA timers keep researchers from being ignored.
Owners fund HuntEscrow on Base from their own wallet. Shipping the fix releases the bounty to the researcher and bumps their on-chain reputation by one.
::: roles
You find leaks, IDOR, RCE in real repos. Sealed reports, paid in $HUNT, reputation on-chain.
You prove repo control, set scope + rewards, decrypt locally, fund escrow. The fix releases it.
Fund standing pools for popular repos or whole ecosystems. Coming in v2.
Prove repo control with GitHub OAuth, publish scope + reward range, and your encryption pubkey is the only thing reports decrypt to. Fund escrow from your own wallet — GitHunt is never custodial.
Wallet-derived encryption keypair, browser-side seal, on-chain reputation. The bounty is the better deal — and the only legitimate path to disclosure on this platform.
