Vulnerability Disclosure Program (VDP)
VDPs are meant for responsibly reporting vulnerabilities you encounter — not for actively hunting for fame or reputation. Even if you're just starting out, consider focusing on rewarded bug bounty programs instead.
nextcloud
94
In Scope
8
Out of Scope
In-Scope Assets (94)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| Desktop Client | BINARY | No | - | |
| apps.nextcloud.com | URL | No | ||
| auth.nextcloud.com | URL | No | ||
| com.nextcloud.Talk | IOS | No | - | |
| com.nextcloud.client | ANDROID | No | ||
| com.nextcloud.talk2 | ANDROID | No | ||
| com.peterandlinda.iOCNotes | IOS | No | - | |
| crm.nextcloud.com | URL | No | ||
| customerupdates.nextcloud.com | URL | No | ||
| docs.nextcloud.com | URL | No | ||
| download.nextcloud.com | URL | No | ||
| help.nextcloud.com | URL | No | ||
| https://github.com/nextcloud/collectives | CODE | No | - | |
| https://github.com/nextcloud/files_confidential | CODE | No | - | |
| https://github.com/nextcloud/tables | CODE | No | - | |
| https://github.com/roundcube/roundcubemail | CODE | No | - | |
| it.niedermann.owncloud.notes | ANDROID | No | ||
| it.twsweb.Nextcloud | IOS | No | - | |
| knowledge.nextcloud.com | URL | No | ||
| lists.nextcloud.com | URL | No | ||
| logs.nextcloud.com | URL | No | ||
| lookup.nextcloud.com | URL | No | ||
| newsletter.nextcloud.com | URL | No | ||
| nextcloud.com | URL | No | ||
| nextcloud/3rdparty | CODE | No | - | |
| nextcloud/activity | CODE | No | - | |
| nextcloud/approval | CODE | No | - | |
| nextcloud/bruteforcesettings | CODE | No | - | |
| nextcloud/calendar | CODE | No | - | |
| nextcloud/calendar_resource_management | CODE | No | - | |
| nextcloud/circles | CODE | No | - | |
| nextcloud/contacts | CODE | No | - | |
| nextcloud/data_request | CODE | No | - | |
| nextcloud/deck | CODE | No | - | |
| nextcloud/end_to_end_encryption | CODE | No | - | |
| nextcloud/external | CODE | No | - | |
| nextcloud/files_accesscontrol | CODE | No | - | |
| nextcloud/files_antivirus | CODE | No | - | |
| nextcloud/files_automatedtagging | CODE | No | - | |
| nextcloud/files_fulltextsearch | CODE | No | - | |
| nextcloud/files_fulltextsearch_tesseract | CODE | No | - | |
| nextcloud/files_lock | CODE | No | - | |
| nextcloud/files_pdfviewer | CODE | No | - | |
| nextcloud/files_retention | CODE | No | - | |
| nextcloud/files_rightclick | CODE | No | - | |
| nextcloud/files_texteditor | CODE | No | - | |
| nextcloud/firstrunwizard | CODE | No | - | |
| nextcloud/flow_notifications | CODE | No | - | |
| nextcloud/fulltextsearch | CODE | No | - | |
| nextcloud/fulltextsearch_elasticsearch | CODE | No | - | |
| nextcloud/globalsiteselector | CODE | No | - | |
| nextcloud/groupfolders | CODE | No | - | |
| nextcloud/guests | CODE | No | - | |
| nextcloud/logreader | CODE | No | - | |
| nextcloud/mail | CODE | No | - | |
| nextcloud/nextcloud_announcements | CODE | No | - | |
| nextcloud/notes | CODE | No | - | |
| nextcloud/notifications | CODE | No | - | |
| nextcloud/notify_push | CODE | No | - | |
| nextcloud/password_policy | CODE | No | - | |
| nextcloud/photos | CODE | No | - | |
| nextcloud/preferred_providers | CODE | No | - | |
| nextcloud/privacy | CODE | No | - | |
| nextcloud/recommendations | CODE | No | - | |
| nextcloud/related_resources | CODE | No | - | |
| nextcloud/richdocuments | CODE | No | - | |
| nextcloud/server | CODE | No | - | |
| nextcloud/serverinfo | CODE | No | - | |
| nextcloud/sharepoint | CODE | No | - | |
| nextcloud/socialsharing | CODE | No | - | |
| nextcloud/spreed | CODE | No | - | |
| nextcloud/survey_client | CODE | No | - | |
| nextcloud/suspicious_login | CODE | No | - | |
| nextcloud/terms_of_service | CODE | No | - | |
| nextcloud/text | CODE | No | - | |
| nextcloud/twofactor_totp | CODE | No | - | |
| nextcloud/twofactor_webauthn | CODE | No | - | |
| nextcloud/updater | CODE | No | - | |
| nextcloud/user_migration | CODE | No | - | |
| nextcloud/user_oidc | CODE | No | - | |
| nextcloud/user_saml | CODE | No | - | |
| nextcloud/viewer | CODE | No | - | |
| nextcloud/workflow_script | CODE | No | - | |
| portal.nextcloud.com | URL | No | ||
| projects.nextcloud.com | URL | No | ||
| push-notifications.nextcloud.com | URL | No | ||
| pushfeed.nextcloud.com | URL | No | ||
| scan.nextcloud.com | URL | No | ||
| static.apps.nextcloud.com | URL | No | ||
| stats.nextcloud.com | URL | No | ||
| support.nextcloud.com | URL | No | ||
| surveyserver.nextcloud.com | URL | No | ||
| updates.nextcloud.com | URL | No | ||
| usercontent.apps.nextcloud.com | URL | No |
Out-of-Scope Assets (8)
| Asset | Category | Bounty | |
|---|---|---|---|
| cloud.nextcloud.com | URL | No | |
| conf.nextcloud.com | URL | No | |
| daita/files_fulltextsearch_tesseract | CODE | No | |
| demo.nextcloud.com | URL | No | |
| drone.nextcloud.com | URL | No | |
| https://nextcloud.atlassian.net/jira/dashboard | URL | No | |
| sentry.nextcloud.com | URL | No | |
| try.nextcloud.com | URL | No |