Single-developer project. Only the latest main receives security fixes.

Do not open a public GitHub issue for security problems.

Email: techlead01.3tify@gmail.com

Include a description, reproduction steps, and any suggested mitigation. You should hear back within a few days. Coordinated disclosure preferred.

BountyHunter reads user-provided API tokens (ANTHROPIC_API_KEY, GITHUB_TOKEN) from a local .env and stores scraped bounty data in a local SQLite database under data/.

Recommendations:

• chmod 600 .env so only your user account can read it
• Do not commit .env or data/ (already in .gitignore)
• Rotate tokens if you suspect leakage; revoke them in the provider dashboard