DorkHunter is a research and discovery tool. Results from search engines and the GitHub API are leads, not proof of vulnerabilities. Search engines index incompletely — a lack of results does not prove absence. Only the program owner determines bounty eligibility.
| Value | Type | Status | Apex |
|---|
Third-party domains are never automatically considered authorized. Mark uncertain assets explicitly.
Note: Google does not support site:*.example.com wildcards. DorkHunter generates site:example.com plus optional per-subdomain sweeps.
Use a fine-grained, read-only token. It is never placed in URLs, client bundles, or logs. By default it is kept for this session only; server-side encrypted persistence requires an encryption key. GitHub code search is limited to 10 requests/minute and 1,000 results per query.