As an open-source project we know and believe in the well-known Linus' law:

Given enough eyeballs, all bugs are shallow

We're inviting researchers all over the globe to take a look at Nextcloud and bring it's security to the next level. If you're interested in learning how we handle security you can read more about it on our dedicated security page __.

Program policy

We know how valuable your time is and employ a "No bullshit policy" that boils down to: Don't be a jerk. Instead of bothering you with a huge list of exclusions we're going to tell you what we're especially looking after:

1. Bugs within Nextcloud server and it's packaged components (see scope below for all qualifying and packaged components)
2. Bugs within the mobile iOS and Android sync clients
3. Bugs within the desktop sync clients for Mac, Windows, and Linux

A bug is for us something that actively allows an attacker to escalate their privileges. Something like "Attacker can delete arbitrary files of other users" is fine, "Missing X-Frame-Options on the download servers" not so much. At the moment we are also considering Denial of Service not a reward worthy vulnerability. (we will acknowledge you though!)

Found a security bug in one of the above-mentioned components? Awesome! Just report it here and we will get back to you. These components are also for what monetary rewards are awarded. Bonus points if you check back with our threat model __before.

Found a bug in one of our websites or so? While we can't offer you any monetary reward we will acknowledge the issue and happily accept reports for it via this platform as well. But please do not run any Denial of Service attacks against our infrastructure or extract user data. Please do also refrain from using automated testing tools against our infrastructure or disclosing bugs to other parties before we have published a patch.

We believe in transparency about our security, so any valid vulnerabilities discovered are always publicly disclosed after a grace period.

Rewards

Our rewards are based on severity and range up to $10,000. To give you some guidance we have compiled below list:

Impact | Definition | Highest possible reward
---|---|---
Critical | Gaining remote code execution on the server as a non-admin user. (i.e. RCE) | $10,000
High | Gaining access to complete user data of any other user. (i.e. Auth Bypass) | $4,000
Medium | Limited disclosure of user data or attacks granting access to a single users' user session. (i.e. XSS with CSP bypass) | $1500
Low | Very limited disclosure of user data or attacks involving a very high unlikely amount of user interaction. | $500