# Nextcloud: bug bounty program on HackerOne

> Nextcloud is a bug bounty program on HackerOne. It received 274 reports in the 90 days to November 7, 2026, about 2.6 per in-scope asset.

- **Company:** Nextcloud
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/nextcloud
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** June 17, 2016
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/nextcloud

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 22 |
| High | $550 | 83 |
| Medium | $221 | 464 |
| Low | $123 | 321 |

- Reports received in the last 90 days: 274 (about 2.6 per in-scope asset)
- Bounties paid in the last 90 days: $25,895
- Bounties paid in total: $153,513
- Researchers participating: 1,098
- Response efficiency: 100%
- First-response target: 3 days
- Triage target: 5 days
- Bounty target: 100 days

## Scope

As imported from HackerOne on November 6, 2026: 106 assets in scope (5 bounty-eligible), 9 out of scope. The policy page is the authority.

- `https://github.com/nextcloud/files_fulltextsearch_tesseract` (URL): in scope, bounty-eligible, max severity critical
- `nextcloud/files_videplayer` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `nextcloud/gallery` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `nextcloud/onlyoffice` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `nextcloud/twofactor_u2f` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `apps.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `auth.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `cloud.nextcloud.com` (URL): out of scope, max severity none
- `com.nextcloud.client` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity medium
- `com.nextcloud.Talk` (APPLE_STORE_APP_ID): in scope, no bounty, max severity medium
- `com.nextcloud.talk2` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity medium
- `com.peterandlinda.iOCNotes` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `conf.nextcloud.com` (URL): out of scope, max severity none
- `crm.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `customerupdates.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `daita/files_fulltextsearch_tesseract` (SOURCE_CODE): out of scope, max severity none
- `demo.nextcloud.com` (URL): out of scope, max severity none
- `Desktop Client` (DOWNLOADABLE_EXECUTABLES): in scope, no bounty, max severity critical
- `discourse.nextcloud.com` (URL): in scope, no bounty, max severity high
- `docs.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `download.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `drone.nextcloud.com` (URL): out of scope, max severity none
- `help.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `http://*.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `http://nextcloud.com` (URL): in scope, no bounty, max severity critical
- `https://github.com/nextcloud` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nextcloud/collectives` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nextcloud/files_confidential` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nextcloud/tables` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/roundcube/roundcubemail` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://nextcloud.atlassian.net/` (URL): out of scope, max severity none
- `https://nextcloud.atlassian.net/jira/dashboard` (URL): out of scope, max severity none
- `it.niedermann.owncloud.notes` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity medium
- `it.twsweb.Nextcloud` (APPLE_STORE_APP_ID): in scope, no bounty, max severity medium
- `knowledge.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `Legacy_asset_scope` (OTHER): in scope, no bounty, max severity low
- `Legacy-asset` (OTHER): in scope, no bounty, max severity low
- `lists.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `logs.nextcloud.com` (URL): in scope, no bounty, max severity critical
- `lookup.nextcloud.com` (URL): in scope, no bounty, max severity critical
- and 75 more on the BugRater page

## Recent public accepted findings

- October 27, 2026: low severity
- October 27, 2026: medium severity, awarded $250
- October 27, 2026: medium severity
- October 27, 2026: low severity
- October 27, 2026: medium severity

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.