About AuditOne

AuditOne is an audit infrastructure provider. We operate TIC OS, the operating system for certification and inspection bodies, a marketplace of vetted security and ISO auditors, and security services such as smart contract audits and penetration tests.

This program covers our smart contracts, our web applications and the digital infrastructure behind them, with a particular focus on TIC OS.

Assets in Scope

Smart contracts

Discount Pool: 0x28e59a982584987708D68754459e0375c9Caf77A (IOTA EVM)

Web applications

• TIC OS: https://cockpit.auditone.io/ (including its APIs, client portals and auditor views)
• Auditor app: https://auditor.auditone.io
• Website: www.auditone.io

Infrastructure

Domains and subdomains under auditone.io and the cloud infrastructure operated by AuditOne for these applications.

Severity and Rewards

Severity and reward amount are determined by AuditOne based on demonstrated impact.

Critical ($3,000 to $10,000)

Reserved exclusively for vulnerabilities in the in-scope AuditOne smart contracts that allow an attacker to steal assets, meaning direct theft of tokens or funds held in the Discount Pool. No web application or infrastructure finding qualifies as Critical.

High ($1,000 to $3,000)

• Access to another customer's data in TIC OS (cross-tenant data access), including through AI features or prompt injection
• Account takeover or authentication bypass on TIC OS or the auditor marketplace
• Remote code execution on AuditOne servers
• Injection flaws (SQL, NoSQL, command) leading to data extraction or modification
• Privilege escalation to administrator or organisation owner roles
• Forging, altering or revoking certificates or audit reports without authorisation
• Smart contract flaws causing permanent freezing of funds or unauthorised minting without direct theft

Medium ($300 to $1,000)

• Stored Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF) on state-changing actions
• Insecure direct object references exposing limited data within a single tenant
• Role or permission bypass within a tenant, for example an auditor accessing records outside their assignment
• Server-Side Request Forgery (SSRF) without access to internal systems
• Exposure of secrets, credentials or sensitive configuration
• Business logic flaws in audit, certification or payment workflows
• Smart contract flaws causing temporary freezing of funds or contract-level denial of service

Low (up to $300)

• Reflected XSS requiring significant user interaction
• Open redirects
• Missing rate limiting on login, password reset or other sensitive endpoints
• User or account enumeration
• Smart contract issues without impact on assets, for example incorrect event emission or view function errors

Out of Scope

• Infrastructure and services of third-party providers (cloud hosting, website builder, email, payment and analytics providers), even where AuditOne uses them
• Websites and applications not listed above, including those of partners or customers
• Pricing oracles and third-party smart contracts
• Clickjacking on pages without sensitive actions, self-XSS, missing security headers or email records (SPF, DKIM, DMARC) without demonstrable impact
• Findings only reproducible in outdated or unsupported browsers
• Reports from automated scanners without a working proof of concept
• Issues already known to us or reported by another researcher first

Rules and Requirements

The following activities are prohibited:

• Any testing with mainnet or public testnet contracts; all smart contract testing should be done on private testnets
• Any testing with pricing oracles or third-party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Accessing, modifying or deleting data belonging to other users or customers; if you encounter such data, stop immediately and report it
• Using any account other than your own test accounts; test accounts on a dedicated TIC OS tenant are available on request
• Creating, altering or revoking real certificates or audit reports
• Denial of service attacks, load testing or automated scanning that degrades service for certification bodies using TIC OS
• Physical attacks against AuditOne offices or data centres
• Publicly disclosing a vulnerability before it has been fixed and we have agreed to disclosure

Reporting

Submit findings via the AuditOne app with a clear description, the affected asset, steps to reproduce and a proof of concept.

Only the first valid report of a vulnerability is eligible for a reward. KYC is required for individuals before payout.

Safe Harbour

Research conducted in good faith and within these rules will not lead to legal action by AuditOne.