Security

BuilderHunt queries public APIs (GitHub, GitLab, Codeberg, DEV.to, Hacker News, and others) to find and score builder profiles. Some of those APIs allow a higher rate limit when a credential is attached — for example a GitHub token.

Any such credential is an operator-managed server secret, configured in our deployment environment. There is no field anywhere in the product where you can enter your own personal access token, API key, or password for a third-party service — we do not collect them, and we never ask for them.

All traffic to and from BuilderHunt is served over HTTPS, which protects data in transit.

Operator-managed secrets (API tokens, signing keys) are never rendered in any page, API response, or client-side bundle, and are redacted before any application log is written.

The builder profiles you see come from public source APIs — the same data anyone could find by visiting that person's GitHub, GitLab, Codeberg, or DEV.to profile directly.

To keep search fast, results are cached for a short period and may be cached separately per organization. A profile removed from BuilderHunt (see "Removal vs. deletion" below) is filtered out of every cache and every fresh search, not just the one currently showing on your screen.

Account deletion removes your own BuilderHunt account and the data tied to it (see our Privacy Policy).

Profile suppression is a different action: it stops a specific external identity (a GitHub/GitLab/Codeberg/DEV.to profile) from appearing on BuilderHunt at all, for every user of the product — even if you have never had a BuilderHunt account. See Remove my profile to start that process.

Suppression removes BuilderHunt's copy of that data. It cannot and does not delete your profile on GitHub, GitLab, Codeberg, DEV.to, or any other upstream platform — those remain under your control on the platform where you created them.

The services BuilderHunt sends any data to are listed in our Privacy Policy (Section 3, "Subprocessors"). That list is kept current with what is actually deployed — we do not add a new subprocessor to product copy before it is live in production.