Today we are happy to announce the Nextcloud bug bounty program. We offer some of the highest bounties in the open source software industry, rewarding responsible disclosure with up to $5,000 for qualifying vulnerabilities!
We have partnered with the HackerOne platform because of its extraordinary popularity among IT security professionals. More than 3,000 hackers have reported over 24,000 bugs via the platform. Running a program on HackerOne allows us to quickly leverage the collective knowledge of a huge amount of these security experts.
„We are thrilled to welcome Nextcloud to the HackerOne community and have the opportunity to again work with Lukas Reschke“, said Marten Mickos, CEO of HackerOne. „Reschke’s experience with open source and running competitive bug bounty programs at scale is sure to benefit Nextcloud security and its customers.“
While we do perform internal research and add pro-active security hardenings all the time (a prominent example being the introduction of same-site cookies) we are always looking for external input as well. Few limitations and exclusions as well as some of the highest rewards in the open source world for responsible disclosure will serve to attract the kind of professional expertise needed to turn this into a success.
We’re confident in our code base and our work and with this project we will bring the Nextcloud security to an even higher level.
Impact
Definition
Maximum possible reward
Critical
Gaining remote code execution on the server as unauthenticated user. (i.e. RCE)
$5,000
High
Gaining access to complete user data of any other user. (i.e. Auth Bypass)
$2,000
Medium
Limited disclosure of user data or attacks granting access to a single users‘ user session. (i.e. XSS)
$750
Low
Very limited disclosure of user data or attacks involving a very high unlikely amount of user interaction.
$250
Note that our websites (nextcloud.com and nextcloud.org) are NOT part of the program, only the software you can find on our install page.
Bechtle und Nextcloud kündigen heute eine vollständig verwaltete Kollaborationsplattform für den öffentlichen Sektor an, die keiner Ausschreibung bedarf und sofort bereitgestellt werden kann.
Our mission is to help individuals, businesses and organizations achieve digital sovereignty and regain control over their data. Nextcloud Hub 5 marks a massive step forward towards achieving this mission, putting the power of AI into your hands – in a way that keeps you in control. New release, new possibilities Hub 5 builds on […]
Microsoft attempts to delay antitrust action by separating Teams from Office, hoping to continue to abuse its market dominance while it 'negotiates' with the EU.
We bring you a major update to the Nextcloud AI Assistant, plus the news we work with several big hosting providers like IONOS and OVHcloud to bring AI-as-a-Service options to you!
We're thrilled to reveal T-Systems, part of Deutsche Telekom and a prominent global IT service provider, as the latest sponsor of Nextcloud Enterprise Day. Join us on April 24, 2024, in Munich, Germany, for this pivotal event.
Wir speichern einige Cookies, um Besucher zu zählen und die Nutzung der Website zu erleichtern. Diese verlassen unseren Server nicht und dienen nicht der Verfolgung Ihrer online-Aktivitäten.
Weitere Informationen hierzu finden Sie in unserer Datenschutzrichtlinie. Anpassen