ownCloud bug bounty programs
owncloud.com Updated
OwnCloud runs three public programs: a self-hosted bug bounty, a Sorona bug bounty and a HackerOne bug bounty (paused).
- Top reward
- Not published
- Programs
- 3
- 3 pay cash
- Targets in scope
- 29
- 7 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
ownCloud
Self-hosted
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
ownCloud
Self-hosted · Bug bounty |
Not published | Full | – | – | Open |
|
ownCloud
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
ownCloud
HackerOne · Bug bounty |
Not published | – | – | – | Paused |
-
- Safe harbor
- Full
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
29 targets across all 3 programs, each listed once with the programs that cover it. 8 excluded.
-
Authentication and session handling on ownCloud 10, including the user backends and SSO integrations for LDAP, SAML and OAuth2, and the app passwords issued to clients
Products and areas
Covered by Sorona
-
Identity and authorisation on Infinite Scale: the OIDC identity provider, the graph API, and the sharing and public-link services
Products and areas
Covered by Sorona
-
ownCloud 10, the AGPL-3.0 PHP server: its core, the WebDAV stack, and the OCS APIs the desktop and mobile clients talk to
Products and areas
Covered by Sorona
-
ownCloud Infinite Scale, the Apache-2.0 Go rewrite: its service set, the proxy that fronts it, and the authentication middleware inside that proxy
Products and areas
Covered by Sorona
-
ownCloud states the target as two products: "we run two private, invite-only bug bounty programs on YesWeHack: one for ownCloud 10 and one for ownCloud Infinite Scale." The public VDP at security.owncloud.com is the way in, and payment turns on ownCloud confirming the finding at CVSS 7.0 or higher
Products and areas
Covered by Sorona
-
Sharing on ownCloud 10 in every flavour it ships: user and group shares, public links with and without passwords, and federated shares to other instances
Products and areas
Covered by Sorona
-
Storage on ownCloud 10: the file cache, the external storage connectors, and the server-side encryption module
Products and areas
Covered by Sorona
-
The apps ownCloud ships with the server, and the admin settings that configure the server and those apps
Products and areas
Covered by Sorona
-
The Infinite Scale storage providers underneath those services, and the web front end on top of them
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.owncloud.com
HackerOne
-
*.owncloud.org
HackerOne
-
Anything ownCloud confirms below CVSS 7.0, which earns no bounty and no invitation regardless of how interesting it is
Sorona
-
Community apps and third-party ownCloud marketplace apps, which are named in neither private program and should be assumed unpaid
Sorona
-
Findings shared with a third party before ownCloud gives written permission, because the policy declares everything a researcher obtains or generates about its products an ownCloud trade secret
Sorona
-
Nextcloud, which forked away from ownCloud and runs its own separate program on its own code
Sorona
-
Reports filed without a YesWeHack username named in them, since the invitation is issued against that account and the payment follows the invitation
Sorona
-
The paused HackerOne program at hackerone.com/owncloud, which is not the live route and will not produce an award
Sorona
Recent changes
Reward and scope changes across every ownCloud program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under owncloud.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.