Responsible Disclosure · Reward
entityOS runs a closed-internet architecture — IP allowlisting, mutual TLS, and self-sovereign identity. If you can break the assumptions that hold it together, we want to hear from you, in good faith, before anyone else does.
Why we run a reward program
Test within scope and we treat you as a partner, not a threat. Our safe-harbour policy has your back.
Every valid report is acknowledged quickly and tracked through to a verified fix.
In-scope, valid findings earn a reward scaled to severity, exploitability and real-world impact.
With your consent, we credit the researchers who help us harden the platform.
What you can test
entityOS is built from a small number of interlocking security layers. Findings against any of these — especially anything that bypasses an assumption the architecture relies on — are exactly what this program exists for.
IP allowlisting, network isolation and the staged access model that gates entry to the platform.
X.509 certificate issuance, validation and the AWS Private CA / local-CA signing flows behind mTLS.
KERI / ACDC credential handling, key-state validation and any path to forging or replaying identity.
Lambda factories, API Gateway endpoints and the IAM boundaries that constrain each function.
S3 object access, allowlist persistence and audit trails — anything enabling silent bypass or tampering.
entityos.io and the console authentication surfaces, including session, registration and certificate flows.
Know the boundaries
Out of scope
In scope
When in doubt, report it. We would far rather review an out-of-scope report than miss a real one. Borderline findings with clear impact are always considered on their merits.
Reward tiers
Each valid report is triaged against severity, how exploitable it is in practice, and the data or systems it puts at risk. The ranges below are guidelines — the final reward is set at entityOS's discretion.
| Severity | Representative impact | Indicative reward |
|---|---|---|
| Critical | Allowlist or mTLS bypass, remote code execution, SSI credential forgery, or full cross-tenant data exposure. | A$600 – A$1,000 |
| High | Authentication bypass, IAM privilege escalation, or a certificate validation flaw with a clear exploit path. | A$400 – A$600 |
| Medium | Stored XSS in a sensitive context, IDOR exposing limited data, or a meaningful logic flaw. | A$200 – A$400 |
| Low | Minor information disclosure or a non-sensitive misconfiguration with limited real-world impact. | Recognition + A$50 – A$200 |
Ranges are indicative only. Final amounts depend on severity, exploitability, report quality and impact, and are determined at entityOS's discretion. A clear, reproducible report with a working proof of concept is always rewarded more highly than the same issue described loosely.
What happens next
Rules of engagement
Only test the systems listed above. If you're unsure whether something is in scope, ask first.
Demonstrate, don't exploit. Stop at proof of concept and never exfiltrate, alter or destroy data.
Don't run volumetric, load or stress testing against production systems or users.
Never access, modify or store another user's data. Use your own test account wherever possible.
Give us a reasonable window — typically 90 days — to remediate before any public disclosure.
Good-faith research that follows these rules will not lead to legal action from entityOS.
Report an issue
Reports go through a single secure form — no email needed. It walks you through everything we need to triage and reward your finding.
Open the report form →
Based in Australia · ibCom
If you find a security issue with our cloud services, check it with us — and if it's valid, we'll reward you for it. The earlier and clearer the report, the better for everyone.