Nextcloud: Rating & Reviews

NR Unrated

Nextcloud

Nextcloud HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Nextcloud? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Program metrics HackerOne · published

HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 23 Sep 2026.

What it pays, by severity

Critical amount not published 22 reports

High amount not published 80 reports

Medium $207 avg 439 reports firm

Low $120 avg 315 reports firm

$147,413 paid to researchers in total, $19,795 of it in the last 90 days. Lifetime figure as HackerOne prints it: evidence this program has paid, not a promise about any one report.

Intake & responsiveness · last 90 days

Reports received

185

in 90 days

Resolved

1,118

all time, last one 2 days ago

Participants

1,044

hunters engaged

Response efficiency

100%

meeting its targets, HackerOne’s figure

SLA misses

targets missed

Reports received · day by day, last 30 days 160–185

25 Aug 185 reports 23 Sep

Response targets it sets itself

First response

3 days

Triage

5 days

Bounty

100 days

Resolution

90 days

A target the program declared, not a measurement of it being met.

Getting in the door

Open to submit. Nothing HackerOne publishes stands between a hunter and a first report here.

Over 34 days (35 snapshots): intake up 6 reports; 90-day payout up $19,795.

See how this programme’s report load compares to others →

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

1,091 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	rtod	819	30 / 48 63%
2	yoyomiski	763	37 / 88 42%
3	vidang04	485	25 / 74 34%
4	rullzer	442	20 / 23 87%
5	se1en	431	31 / 50 62%
6	daroo	398	15 / 15 100%
7	0x0doteth	388	24 / 36 67%
8	mikaelgundersen	361	12 / 18 67%
9	ctulhu	309	13 / 21 62%
9	b42f97eb69dddcafe5cc278	79	2 / 2 100%
10	cybertechajju	308	0 / 0
11	bornwinnerrr	290	15 / 24 63%
12	systemkeeper	273	30 / 31 97%
13	bncrypted	271	8 / 9 89%
14	hackit_bharat	268	14 / 30 47%
15	lukasreschke	251	16 / 16 100%
16	foobar7	227	11 / 13 85%
17	shakierbellows	203	3 / 3 100%
18	spell1	177	11 / 17 65%
19	suul	176	10 / 15 67%
20	supr4s	169	12 / 15 80%
21	netranger	159	7 / 11 64%
21	ryotak	159	5 / 5 100%
23	kesselb	156	18 / 19 95%
23	b911bade858ce8e6a0f50f8	80	5 / 6 83%

Showing the top 25 of 1,091 credited on HackerOne.

Program profile HackerOne · imported

Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 16 Sep 2026.

Access, share and protect your files, calendars, contacts, communication & more at home and in your enterprise.

Responsiveness

100% HackerOne’s figure

Swag

Currency

USD

Submissions

Open

Launched

Jun 2016

Scope entries

117 HackerOne’s count

Scope

115 assets

Asset	Type	Eligibility	Max severity
https://github.com/nextcloud/files_fulltextsearch_tesseract	URL	✓ bounty	Critical
nextcloud/files_videplayer	SOURCE CODE	✓ bounty	Critical
nextcloud/gallery	SOURCE CODE	✓ bounty	Critical
nextcloud/onlyoffice	SOURCE CODE	✓ bounty	Critical
nextcloud/twofactor_u2f	SOURCE CODE	✓ bounty	Critical

Show all 115 assets

Asset	Type	Eligibility	Max severity
apps.nextcloud.com	URL	submit only	Critical
auth.nextcloud.com	URL	submit only	Critical
cloud.nextcloud.com	URL	out	None
com.nextcloud.client	GOOGLE PLAY APP ID	submit only	Medium
com.nextcloud.Talk	APPLE STORE APP ID	submit only	Medium
com.nextcloud.talk2	GOOGLE PLAY APP ID	submit only	Medium
com.peterandlinda.iOCNotes	APPLE STORE APP ID	submit only	Critical
conf.nextcloud.com	URL	out	None
crm.nextcloud.com	URL	submit only	Critical
customerupdates.nextcloud.com	URL	submit only	Critical
daita/files_fulltextsearch_tesseract	SOURCE CODE	out	None
demo.nextcloud.com	URL	out	None
Desktop Client	DOWNLOADABLE EXECUTABLES	submit only	Critical
discourse.nextcloud.com	URL	submit only	High
docs.nextcloud.com	URL	submit only	Critical
download.nextcloud.com	URL	submit only	Critical
drone.nextcloud.com	URL	out	None
help.nextcloud.com	URL	submit only	Critical
http://*.nextcloud.com	URL	submit only	Critical
http://nextcloud.com	URL	submit only	Critical
https://github.com/nextcloud	SOURCE CODE	submit only	Critical
https://github.com/nextcloud/collectives	SOURCE CODE	submit only	Critical
https://github.com/nextcloud/files_confidential	SOURCE CODE	submit only	Critical
https://github.com/nextcloud/tables	SOURCE CODE	submit only	Critical
https://github.com/roundcube/roundcubemail	SOURCE CODE	submit only	Critical
https://nextcloud.atlassian.net/	URL	out	None
https://nextcloud.atlassian.net/jira/dashboard	URL	out	None
it.niedermann.owncloud.notes	GOOGLE PLAY APP ID	submit only	Medium
it.twsweb.Nextcloud	APPLE STORE APP ID	submit only	Medium
knowledge.nextcloud.com	URL	submit only	Critical
Legacy_asset_scope	OTHER	submit only	Low
Legacy-asset	OTHER	submit only	Low
lists.nextcloud.com	URL	submit only	Critical
logs.nextcloud.com	URL	submit only	Critical
lookup.nextcloud.com	URL	submit only	Critical
newsletter.nextcloud.com	URL	submit only	Low
nextcloud.com	URL	submit only	Critical
nextcloud/3rdparty	SOURCE CODE	submit only	Critical
nextcloud/activity	SOURCE CODE	submit only	Critical
nextcloud/approval	SOURCE CODE	submit only	Critical
nextcloud/bruteforcesettings	SOURCE CODE	submit only	Critical
nextcloud/calendar	SOURCE CODE	submit only	Critical
nextcloud/calendar_resource_management	SOURCE CODE	submit only	Critical
nextcloud/circles	SOURCE CODE	submit only	Critical
nextcloud/contacts	SOURCE CODE	submit only	Critical
nextcloud/data_request	SOURCE CODE	submit only	Critical
nextcloud/deck	SOURCE CODE	submit only	Critical
nextcloud/end_to_end_encryption	SOURCE CODE	submit only	Critical
nextcloud/external	SOURCE CODE	submit only	Critical
nextcloud/files_accesscontrol	SOURCE CODE	submit only	Critical
nextcloud/files_antivirus	SOURCE CODE	submit only	Critical
nextcloud/files_automatedtagging	SOURCE CODE	submit only	Critical
nextcloud/files_fulltextsearch	SOURCE CODE	submit only	Critical
nextcloud/files_fulltextsearch_tesseract	SOURCE CODE	submit only	Critical
nextcloud/files_lock	SOURCE CODE	submit only	Critical
nextcloud/files_pdfviewer	SOURCE CODE	submit only	Critical
nextcloud/files_retention	SOURCE CODE	submit only	Critical
nextcloud/files_rightclick	SOURCE CODE	submit only	Critical
nextcloud/files_texteditor	SOURCE CODE	submit only	Critical
nextcloud/firstrunwizard	SOURCE CODE	submit only	Critical
nextcloud/flow_notifications	SOURCE CODE	submit only	Critical
nextcloud/fulltextsearch	SOURCE CODE	submit only	Critical
nextcloud/fulltextsearch_elasticsearch	SOURCE CODE	submit only	Critical
nextcloud/globalsiteselector	SOURCE CODE	submit only	Critical
nextcloud/groupfolders	SOURCE CODE	submit only	Critical
nextcloud/guests	SOURCE CODE	submit only	Critical
nextcloud/logreader	SOURCE CODE	submit only	Critical
nextcloud/mail	SOURCE CODE	submit only	Critical
nextcloud/nextcloud_announcements	SOURCE CODE	submit only	Critical
nextcloud/notes	SOURCE CODE	submit only	Critical
nextcloud/notifications	SOURCE CODE	submit only	Critical
nextcloud/notify_push	SOURCE CODE	submit only	Critical
nextcloud/password_policy	SOURCE CODE	submit only	Critical
nextcloud/photos	SOURCE CODE	submit only	Critical
nextcloud/preferred_providers	SOURCE CODE	submit only	Critical
nextcloud/privacy	SOURCE CODE	submit only	Critical
nextcloud/recommendations	SOURCE CODE	submit only	Critical
nextcloud/related_resources	SOURCE CODE	submit only	Critical
nextcloud/richdocuments	SOURCE CODE	submit only	Critical
nextcloud/server	SOURCE CODE	submit only	Critical
nextcloud/serverinfo	SOURCE CODE	submit only	Critical
nextcloud/sharepoint	SOURCE CODE	submit only	Critical
nextcloud/socialsharing	SOURCE CODE	submit only	Critical
nextcloud/spreed	SOURCE CODE	submit only	Critical
nextcloud/survey_client	SOURCE CODE	submit only	Critical
nextcloud/suspicious_login	SOURCE CODE	submit only	Critical
nextcloud/terms_of_service	SOURCE CODE	submit only	Critical
nextcloud/text	SOURCE CODE	submit only	Critical
nextcloud/twofactor_totp	SOURCE CODE	submit only	Critical
nextcloud/twofactor_webauthn	SOURCE CODE	submit only	Critical
nextcloud/updater	SOURCE CODE	submit only	Critical
nextcloud/user_migration	SOURCE CODE	submit only	Critical
nextcloud/user_oidc	SOURCE CODE	submit only	Critical
nextcloud/user_saml	SOURCE CODE	submit only	Critical
nextcloud/viewer	SOURCE CODE	submit only	Critical
nextcloud/workflow_script	SOURCE CODE	submit only	Critical
portal.nextcloud.com	URL	submit only	Critical
projects.nextcloud.com	URL	submit only	Critical
push-notifications.nextcloud.com	URL	submit only	Critical
pushfeed.nextcloud.com	URL	submit only	Low
scan.nextcloud.com	URL	submit only	Critical
sentry.nextcloud.com	URL	out	None
static.apps.nextcloud.com	URL	submit only	Critical
stats.nextcloud.com	URL	submit only	Critical
support.nextcloud.com	URL	submit only	Critical
surveyserver.nextcloud.com	URL	submit only	Critical
try.nextcloud.com	URL	out	None
updates.nextcloud.com	URL	submit only	Critical
usercontent.apps.nextcloud.com	URL	submit only	Critical
https://download.nextcloud.com/server/releases/latest-12.tar.bz2	DOWNLOADABLE EXECUTABLES	submit only	Critical

HackerOne lists 117 scope entries; its public listing groups many assets under one label, so identical entries are shown once.