Nearly one year ago we introduced the Nextcloud bug bounty program offering a significant monetary reward for reports of security vulnerabilities within Nextcloud. Security Bug Bounties are a ‘security best practice’ followed by large organizations like Microsoft, Uber, Github, Twitter and Slack which we’ve embraced. We’re proud to offer some of the highest bounties in the open source software industry, rewarding responsible disclosure with up to $5,000 for qualifying vulnerabilities. We’re also proud of our 8 hour response time and quick bug fix turn-around! We thought that it is time to do a short recap on the progress of our program and invite more people to participate.
security is hard, and mistakes are just unavoidable
However, we can make it as hard as possible for an attacker. We do that first by having a strong process aimed at writing secure code, training our developers to take security in account and reviewing designs in advance and the code itself after it has been written. Second, we secure Nextcloud pro-actively by introducing security hardenings which decrease the likelihood of a successful exploitation. By performing internal testing, we get the confidence required for shipping. And last but not least external testing such as via our bug bounty program on HackerOne gives us another set of hundreds of eyes looking over our code and potentially discovering issues within our software.
Something that especially sparks our interests are reports involving a bypass of security hardenings. After a report of a security issue, we perform a root-cause analysis and try to aim to mitigate problems of this category completely in the future. A recent example was, for example, us hardening our shipped jQuery library in addition to fixing the reported vulnerability.
As you see, running a bug bounty program is something you should take seriously to get the most out of it. It does not replace internal security expertise but rather augments it, providing opportunities to fix whole classes of potential issues at once.
Reports in numbers
In the last year, we have had reports by 358 different white hat hackers reporting 676 issues to us, averaging around 1.8 reports per reporter. As you can see, most of these reports have been done right after we announced our bug bounty program which took some more internal coordination to handle. Nowadays, we get a steady stream of around 5-10 reports a week.
Of those 676 reports, we acted on 77 unique issues which have been reported by 83 different reporters. The other 599 issues were not considered a security risk or either duplicate of existing issues:
From these 77 reports, 18 qualified for monetary awards as they were within the Nextcloud software while the others targeted our infrastructure which we excluded from our bug bounty scope.
In total we spent $5,083 on bug bounties, resulting in an average bounty of $282.
We are quite proud of our performance, our all time response time is eight hours and our all time resolution time is about one month.
Those numbers mean that after an issue got reported to us the reporter receives a feedback usually within 8 hours. In average the issue has also been fixed, reviewed, regression tested and finally shipped to Nextcloud users in about one month.
The bug bounty program would not be so successful with the dozens of skillful hackers participating in it. We would like to give a special shout-out to those top 5 five reporters in our program:
Those five people are just a small sample of all the hackers that helped us until now. We would like to extend our sincere thanks to every single one! Thanks to all of you for making the internet a more secure place.
If you want to be featured in our next bug bounty program update head over to our bug bounty program on HackerOne and start submitting vulnerabilities. We look forward to your reports!
Nextcloud Enterprise Day is soon here and we have an amazing lineup of speakers providing insightful talks! One of those speakers is George Imrie from Nextcloud customer T-Systems – Deutsche Telekom’s business-customer IT affiliate. T-Systems is a digital transformation specialist, with operations in 20 countries worldwide.In preparation for their talk at the Nextcloud Enteprise Day […]
Last week, Nextcoud CEO Frank Karlitschek appeared on one of Germany’s biggest public service TV broadcaster’s: ZDF. Watch the news item by ZDF here. Interviewed in Nextcloud’s Berlin office, Frank explains the challenge the company faces up against big tech giants like Google and Microsoft. “That’s all very difficult for us, due to the fact […]
Nextcloud Enterprise Day is soon here and we have an amazing lineup of speakers providing insightful talks! One of those speakers is Mr. Birkner from the State Institute for School Quality and Teacher Training in Saxony-Anhalt (LISA) in Germany. In preparation for his talk at the Nextcloud Enteprise Day on June 13th, we asked him […]