详细内容
The world's first bug bounty platform for AI/ML
huntr provides a single place for security researchers to submit vulnerabilities, to ensure the security and stability of AI/ML open-source apps and libraries and ML model file formats.
JOIN US* HANG OUT
*by logging in you agree to our terms of service
JOIN US* HANG OUT
*by logging in you agree to our terms of service
240+ AI/ML Programs
\
\
NVIDIA/nvidia-container-toolkit\
\
$1500 
\
\
langgenius/dify\
\
$0 
\
\
apache/spark\
\
$1500 
\
\
huggingface/text-generation-inference\
\
$1500 
\
\
intel/neural-compressor\
\
$1500 
\
\
urllib3/urllib3\
\
$0 
\
\
mongodb/mongo-python-driver\
\
$1500 \
\
huggingface/transformers\
\
$1500 
\
\
pytorch/pytorch\
\
$1500 
\
\
keras-team/keras\
\
$1500 \
\
apache/airflow\
\
$1200 
\
\
onnx/onnx\
\
$1500 
\
\
jupyter/jupyter\
\
$1200 
\
\
mlflow/mlflow\
\
$1500 
\
\
aws/aws-cli\
\
$1200 
\
\
nltk/nltk\
\
$1500 
\
\
kubeflow/kubeflow\
\
$1500 \
\
apache/arrow\
\
$1200 \
\
apache/tvm\
\
$1500 
\
\
deepmind/sonnet\
\
$900 \
\
NVIDIA/TensorRT\
\
$1500 
\
\
triton-inference-server/server\
\
$1500 \
\
huggingface/tokenizers\
\
$1500 
\
\
Netflix/metaflow\
\
$1200 
\
\
wandb/wandb\
\
$0 
\
\
elastic/elasticsearch-py\
\
$1200 \
\
pytorch/serve\
\
$1500 
\
\
h5py/h5py\
\
$1200 
\
\
scikit-optimize/scikit-optimize\
\
$900 \
\
keras-team/keras-tuner\
\
$900 \
\
aws/sagemaker-python-sdk\
\
$1500 
\
\
bananaml/banana-python-sdk\
\
$0 
\
\
run-llama/llama_index\
\
$1500 
\
\
facebookresearch/faiss\
\
$1500 \
\
facebookresearch/fairseq\
\
$1500 
\
\
deepjavalibrary/djl\
\
$1500 
\
\
ollama/ollama\
\
$1500 \
\
huggingface/smolagents\
\
$500
\
\
NVIDIA/nvidia-container-toolkit\
\
$1500 \
\
langgenius/dify\
\
$0 \
\
apache/spark\
\
$1500 \
\
huggingface/text-generation-inference\
\
$1500 \
\
intel/neural-compressor\
\
$1500 \
\
urllib3/urllib3\
\
$0 \
\
mongodb/mongo-python-driver\
\
$1500 \
\
huggingface/transformers\
\
$1500 \
\
pytorch/pytorch\
\
$1500 \
\
keras-team/keras\
\
$1500 \
\
apache/airflow\
\
$1200 \
\
onnx/onnx\
\
$1500 \
\
jupyter/jupyter\
\
$1200 \
\
mlflow/mlflow\
\
$1500 \
\
aws/aws-cli\
\
$1200 \
\
nltk/nltk\
\
$1500 \
\
kubeflow/kubeflow\
\
$1500 \
\
apache/arrow\
\
$1200 \
\
apache/tvm\
\
$1500 \
\
deepmind/sonnet\
\
$900 \
\
NVIDIA/TensorRT\
\
$1500 \
\
triton-inference-server/server\
\
$1500 \
\
huggingface/tokenizers\
\
$1500 \
\
Netflix/metaflow\
\
$1200 \
\
wandb/wandb\
\
$0 \
\
elastic/elasticsearch-py\
\
$1200 \
\
pytorch/serve\
\
$1500 \
\
h5py/h5py\
\
$1200 \
\
scikit-optimize/scikit-optimize\
\
$900 \
\
keras-team/keras-tuner\
\
$900 \
\
aws/sagemaker-python-sdk\
\
$1500 \
\
bananaml/banana-python-sdk\
\
$0 \
\
run-llama/llama_index\
\
$1500 \
\
facebookresearch/faiss\
\
$1500 \
\
facebookresearch/fairseq\
\
$1500 \
\
deepjavalibrary/djl\
\
$1500 \
\
ollama/ollama\
\
$1500 \
\
huggingface/smolagents\
\
$500
\
\
NVIDIA/nvidia-container-toolkit\
\
$1500 \
\
langgenius/dify\
\
$0 \
\
apache/spark\
\
$1500 \
\
huggingface/text-generation-inference\
\
$1500 \
\
intel/neural-compressor\
\
$1500 \
\
urllib3/urllib3\
\
$0 \
\
mongodb/mongo-python-driver\
\
$1500 \
\
huggingface/transformers\
\
$1500 \
\
pytorch/pytorch\
\
$1500 \
\
keras-team/keras\
\
$1500 \
\
apache/airflow\
\
$1200 \
\
onnx/onnx\
\
$1500 \
\
jupyter/jupyter\
\
$1200 \
\
mlflow/mlflow\
\
$1500 \
\
aws/aws-cli\
\
$1200 \
\
nltk/nltk\
\
$1500 \
\
kubeflow/kubeflow\
\
$1500 \
\
apache/arrow\
\
$1200 \
\
apache/tvm\
\
$1500 \
\
deepmind/sonnet\
\
$900 \
\
NVIDIA/TensorRT\
\
$1500 \
\
triton-inference-server/server\
\
$1500 \
\
huggingface/tokenizers\
\
$1500 \
\
Netflix/metaflow\
\
$1200 \
\
wandb/wandb\
\
$0 \
\
elastic/elasticsearch-py\
\
$1200 \
\
pytorch/serve\
\
$1500 \
\
h5py/h5py\
\
$1200 \
\
scikit-optimize/scikit-optimize\
\
$900 \
\
keras-team/keras-tuner\
\
$900 \
\
aws/sagemaker-python-sdk\
\
$1500 \
\
bananaml/banana-python-sdk\
\
$0 \
\
run-llama/llama_index\
\
$1500 \
\
facebookresearch/faiss\
\
$1500 \
\
facebookresearch/fairseq\
\
$1500 \
\
deepjavalibrary/djl\
\
$1500 \
\
ollama/ollama\
\
$1500 \
\
huggingface/smolagents\
\
$500
\
\
NVIDIA/nvidia-container-toolkit\
\
$1500 \
\
langgenius/dify\
\
$0 \
\
apache/spark\
\
$1500 \
\
huggingface/text-generation-inference\
\
$1500 \
\
intel/neural-compressor\
\
$1500 \
\
urllib3/urllib3\
\
$0 \
\
mongodb/mongo-python-driver\
\
$1500 \
\
huggingface/transformers\
\
$1500 \
\
pytorch/pytorch\
\
$1500 \
\
keras-team/keras\
\
$1500 \
\
apache/airflow\
\
$1200 \
\
onnx/onnx\
\
$1500 \
\
jupyter/jupyter\
\
$1200 \
\
mlflow/mlflow\
\
$1500 \
\
aws/aws-cli\
\
$1200 \
\
nltk/nltk\
\
$1500 \
\
kubeflow/kubeflow\
\
$1500 \
\
apache/arrow\
\
$1200 \
\
apache/tvm\
\
$1500 \
\
deepmind/sonnet\
\
$900 \
\
NVIDIA/TensorRT\
\
$1500 \
\
triton-inference-server/server\
\
$1500 \
\
huggingface/tokenizers\
\
$1500 \
\
Netflix/metaflow\
\
$1200 \
\
wandb/wandb\
\
$0 \
\
elastic/elasticsearch-py\
\
$1200 \
\
pytorch/serve\
\
$1500 \
\
h5py/h5py\
\
$1200 \
\
scikit-optimize/scikit-optimize\
\
$900 \
\
keras-team/keras-tuner\
\
$900 \
\
aws/sagemaker-python-sdk\
\
$1500 \
\
bananaml/banana-python-sdk\
\
$0 \
\
run-llama/llama_index\
\
$1500 \
\
facebookresearch/faiss\
\
$1500 \
\
facebookresearch/fairseq\
\
$1500 \
\
deepjavalibrary/djl\
\
$1500 \
\
ollama/ollama\
\
$1500 \
\
huggingface/smolagents\
\
$500
Submission process
The story of vulnerability disclosure, from start to finish.
1. Disclose
Researcher finds and submits a vulnerability using our secure form.
2. Validate
We contact the maintainer then reach out again once every 7 days. We allow the maintainer 31 days to respond to the report. If no response is received, we will manually resolve high and critical reports within 14 days.
3. Reward
If the report is determined to be valid by either the maintainer or huntr, the researcher is rewarded a bounty. Open source reports are also awarded a CVE and a fix bounty may be awarded to the maintainer for patching the vulnerability and merging the patch. We will soon support the ability for researchers to submit a patch and claim the fix bounty but this is not supported yet.
4. Publish
All open source vulnerability reports go public on day 90 but maintainers may request an extension if needed. Open source reports marked informational or invalid go public immediately. Reports pertaining to Model File Formats are not disclosed publicly.
Start learning
Get your First CVE with Vulnhuntr 
GGUF File Format Vulnerabilities 
Backdooring AI File Formats
Cookies
huntr uses tracking cookies to understand how you interact with the platform.
AcceptReject
Manage preferences