Security & Vulnerability Disclosure

We take the security of HatTest seriously and welcome reports from the security community. If you believe you’ve found a vulnerability in the Service (the site or the API at hattest.ai), please tell us — we’ll work with you to confirm and fix it.

How to report

Email support@hattest.ai with “Security” in the subject, or use our contact form. Please include enough detail to reproduce: the affected URL/endpoint, steps, and any proof-of-concept. A machine-readable pointer to this policy is published at /.well-known/security.txt (RFC 9116).

Scope

In scope: hattest.ai and its API/Worker. Out of scope: any third-party website or backend you scanned through HatTest (those belong to their owners — report to them), volumetric denial-of-service, social engineering of our staff, and findings that require a compromised device or already-privileged account.

Safe harbor

We will not pursue or support legal action against researchers who, in good faith, discover and report a vulnerability in scope, provided they avoid privacy violations, service degradation, and destruction or exfiltration of data beyond the minimum needed to demonstrate the issue. Give us a reasonable chance to remediate before any public disclosure.

What to expect

We aim to acknowledge reports within a few business days and to keep you updated as we investigate and remediate. We don’t currently run a paid bug-bounty program, but we’re grateful for responsible reports and happy to credit reporters who’d like recognition.