- Top reward
- $1,000
- Top severity paid
- Critical
- Assets in scope
- 117
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $1,000
- for critical bugs.
- Report through their form
- hackerone.com/8x8-bounty
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,000 |
| High |
|
$500 |
| Medium |
|
$250 |
| Low |
|
$50 |
- Response
-
Within 1 days
Time to first response (from report submit) - 1 business days
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
117 assets you may test, 23 excluded.
Wildcard domains 49
- *.8x8.cloud Critical No bounty
- *.8x8cloud.net Critical
- *.8x8.com Critical No bounty
- *.8x8.co.uk Critical No bounty
- *.8x8e2e.com Critical No bounty
- *.8x8.engineering Critical No bounty
- *.8x8hosts.internal Medium No bounty
- *.8x8hosts.pilot Medium No bounty
- *.8x8.id Critical No bounty
- *.8x8pilot.com Medium No bounty
- *.8x8staging.com Critical No bounty
- *.8x8.studio Medium No bounty
- *.8x8testa.com Medium No bounty
- *.8x8testb.com Medium No bounty
- *.8x8.uk Critical No bounty
- *.8x8.vc Critical No bounty
- *.acceptance.cloud.8x8.com High No bounty
- *.ai.8x8.vc Medium No bounty
- analytics-*.8x8.com Critical No bounty
- *.call-control.ie Critical No bounty
- *.cceng.8x8.com Medium No bounty
- *.chalet.8x8.com Critical
- *.chalet.8x8.com/ws/v1 Critical
- *.fuze.com Low No bounty
- *.fuze.site Low No bounty
- *.in2tel.ie Critical No bounty
- *.jit.si Critical No bounty
- *.jitsi.net Critical No bounty
- *.labs.8x8.com High No bounty
- *.mavenlab.com Informational No bounty
- *.moobicast.com Informational No bounty
- *.moobidesk.com Informational No bounty
- *.ociadmin.cloud.8x8.com High No bounty
- *.p8t.us Critical
- *.packet8.net Critical
- *.packet8-pilot.net Medium No bounty
- *.preview.8x8.vc Medium No bounty
- *.prod.cloud.8x8.com Critical No bounty
- qm-*.8x8.com Critical No bounty
- *.rekap.8x8.com High No bounty
- *.staging.cloud.8x8.com Medium No bounty
- *.thinkingphones.com Critical No bounty
- *.thinkingphones.net Critical No bounty
- *.ucverse.com Critical No bounty
- *.unreal-agents.com Medium No bounty
- *.unreal-agents.jitsi.net Medium No bounty
- vcc-*.8x8.com Critical
- *-vpn.8x8.com High No bounty
- *.wavecell.com Critical No bounty
Web 42
- 8x8.my.site.com High No bounty
- admin.8x8.com Critical
- admin-resolve.8x8.com High No bounty
- api.8x8.com Critical No bounty
- apps.8x8.com Critical
- bridge.8x8.com Critical No bounty
- callroute.com Critical No bounty
- callroute.io Critical No bounty
- cloud8.8x8.com Critical No bounty
- community.8x8.com High No bounty
- connect.8x8.com Critical No bounty
- converse.8x8.com Medium No bounty
- dashboard.qa.ai.8x8.com Critical No bounty
- debug.8x8.com Medium No bounty
- developer.8x8.com High No bounty
- eg.ht Medium No bounty
- fuze.me Low No bounty
- https://8x8.vc/xmpp-websocket Critical No bounty
- https://webrtc.8x8.com Critical
- maestro.8x8.cloud Critical No bounty
- map.8x8.com Critical No bounty
- mcp.8x8.com Critical No bounty
- pay.8x8.com Critical
- platform.8x8.com Critical
- platform.8x8pilot.com Critical
- pubtools.private.8x8cloud.net High No bounty
- resolve.8x8.com High No bounty
- sipsynergy.co.uk Critical No bounty
- sso.8x8.com Critical
- sso.8x8pilot.com Critical
- support-portal.8x8.com Medium No bounty
- uc.8x8pilot.com Critical
- unreal-agents.8x8pilot.com Medium No bounty
- user-profile.8x8.com Critical
- user-profile-staging.8x8.com Critical
- vap.8x8.com Critical No bounty
- vcc-ce.8x8.com Critical No bounty
- video-agent.8x8.com High No bounty
- voapi.8x8.com Critical No bounty
- work.8x8.com Critical
- work-staging.8x8.com Critical
- www.fuzemeeting.com Low No bounty
Android apps 1
- org.vom8x8.sipua Critical No bounty
APIs 1
- 8x8 Communication APIs Critical No bounty
Desktop and binaries 1
- Virtual Office Desktop Critical No bounty
iOS apps 1
- 8x8-work Critical No bounty
Source code 1
- https://github.com/jitsi Low No bounty
Products and areas 21
- 8x8 Partner Portal High No bounty
- ASN: AS10976 Low No bounty
- ASN: AS133144 Critical No bounty
- ASN: AS13896 Low No bounty
- ASN: AS14294 Low No bounty
- ASN: AS198554 Critical No bounty
- ASN: AS199687 Critical No bounty
- ASN: AS206422 Critical No bounty
- ASN: AS32308 Critical No bounty
- ASN: AS395362 Critical No bounty
- ASN: AS398067 Critical No bounty
- ASN: AS44965 Critical No bounty
- ASN: AS46680 Critical No bounty
- ASN: AS49856 Critical No bounty
- ASN: AS62306 Critical No bounty
- ASN: AS62876 Critical No bounty
- Cloud Misconfigurations Critical No bounty
- Discovered Leaked Credentials High No bounty
- https://www.npmjs.com/package/@8x8/pui-partner-comm High No bounty
- Intellectual Property on Public Domains Critical
- Third Party Application High No bounty
Out of scope (23)
- com.spot8x8.spot
- org.jitsi.meet
- Jitsi Meet Desktop
- 8x8-meeting-rooms
- com.atlassian.JitsiMeet.ios
- 8x8.wavecell.com
- accountmanager.8x8.com
- express.8x8.com
- feedback.wavecell.com
- get8x8.com
- investors.8x8.com
- mobileidentity.8x8.com
- supersite.8x8.com
- support.8x8.com
- vm.8x8.com
- www.8x8.com
- www.wavecell.com
- *.bell.ca
- *.callstats.io
- *.contactnow.8x8.com
- *.jitsi.org
- *.msteams.8x8.com
- *.sameroom.io
Rules
What the policy asks of you, and the bug types it won't reward, quoted from 8x8 (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Conduct automated or high-volume testing without prior coordination
-
Perform any activity that could disrupt our service (DoS/DDoS)
-
Send spam or unsolicited communications
-
Engage in social engineering or phishing of 8x8 staff or contractors
-
Make physical attempts against 8x8 property or data centers
-
Please utilize your [username]@wearehackerone.com alias when submitting information within the applications.
-
8x8 requests you to include your HackerOne username value to each and every HTTP request made by yourself or any tooling you use.
-
Please do not discuss vulnerabilities outside of the program without proper coordination and express consent from 8x8.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
Not accepted
-
Missing security headers (HSTS, CSP, SPF, DMARC, X-Frame-Options, etc.)
-
Missing cookie flags (Secure, HttpOnly, SameSite) without demonstrated exploit
-
SSL/TLS configuration issues (weak ciphers, key size, deprecated protocols, BEAST, CRIME)
-
Software version disclosure, banner identification, or descriptive error messages
-
Clickjacking on non-sensitive pages
-
Self-XSS without further security impact
-
CSRF on unauthenticated forms or forms with no sensitive action
-
CSV injection without demonstrated impact
-
Tab-nabbing
-
Credential stuffing attacks (users are responsible for password uniqueness and enabling MFA)
-
Rate limiting or brute force issues without demonstrated account compromise
-
Issues requiring MITM or physical access to a user's device
-
Vulnerable libraries or dependencies without a demonstrated Proof of Concept showing exploitability in our application context
-
Issues only affecting outdated browsers (more than 2 stable versions behind current release)
-
Public zero-day vulnerabilities patched less than 1 month ago (evaluated case-by-case)
-
Low-severity issues reported by automated scanners without demonstrated security impact or exploitation path
-
IDORs having unguessable/non-enumerable identifier are out of scope
-
IDORs in form of an UUID
-
IDORs based on `AccountId` and `subAccountId`
-
Findings requiring a malicious or attacker-controlled application installed on the victim's device
-
Task hijacking (StrandHogg) vulnerabilities
-
Insecure data storage on rooted or jailbroken devices
-
Issues requiring local code execution in the context of another application
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
eg.ht
-
Scope added
*.rekap.8x8.com
-
Scope added
bridge.8x8.com
-
Scope added
*.8x8.cloud
-
Scope added
*.8x8.engineering
-
Scope removed
8x8.cloud
-
Scope added
map.8x8.com
-
Scope added
https://*.chalet.8x8.com/ws/v1
-
Scope added
*.labs.8x8.com
-
Scope added
mcp.8x8.com
-
Scope added
*.8x8.studio
-
Scope added
pubtools.private.8x8cloud.net
-
Scope added
admin-resolve.8x8.com
-
Scope added
resolve.8x8.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
At 8x8, we help companies get their employees, customers and applications talking to make people more connected and productive no matter where they are in the world. At 8x8 we value security and recognize the importance of ensuring the integrity and confidentiality of global communications.
8x8 Product Scope
| 8x8 Work | All your essential business communications brought together in one simple app. |
|---|---|
| ⚠️ Testing accounts or credentials are not being provided at this time. | |
| ⚠️ Product Assets: |
- Web App: https://work.8x8.com/
- 8x8 Work for Desktop: https://support-portal.8x8.com/helpcenter/viewArticle.html?d=8bff4970-6fbf-4daf-842d-8ae9b533153d
- iOS App: https://apps.apple.com/us/app/8x8-work/id348177448
- Android App: https://play.google.com/store/apps/details?id=org.vom8x8.sipua
| 8x8 Virtual Contact Center | A complete, secure cloud contact center solution that makes it easy to collaborate with agents and improve customer experiences. |
|---|---|
| ⚠️ Testing accounts or credentials are not being provided at this time. | |
| ⚠️ We will accept one unique report for the application across all related domains as assumed single fix unless proven otherwise. | |
| ⚠️ Latest version of software usually available on https://vcc-na30.8x8.com/ | |
| ⚠️ Product Assets: |
- Configuration Manager: vcc-*.8x8.com/CM/
- 8x8 Agent Workspace: vcc-*.8x8.com/AGUI/
- 8x8 Quality Management: vcc-*.8x8.com/QM/
- 8x8 Supervisor Workspace: https://superx.8x8.com/
- 8x8 Analytics for Contact Center: analytics-*.8x8.com
⚠️ Additional Testing Information regarding "Contact Center Agent Workspace":
- For the application to work properly behind a Proxy (e.g. BURP), an exception has to be added for
jabbind3.php- Proxy settings
- Search "streaming"
- Add
https://vcc-na1.8x8.com/agui/jabbind3.php(e.g.) as "Streaming responses" - {F3427433}
| Jitsi | Jitsi is a world class open source video meeting solution. We strive to make a flexible and secure video meetings platform with the option of end-to-end encryption (beta). |
|---|---|
| ⚠️ Have a feature request or bug not related to security? Let us know or contribute yourself: https://github.com/jitsi/ | |
| ⚠️ Product Assets: |
- Infrastructure: *.jitsi.net
- Infrastructure: *.jit.si
- Source Code: https://github.com/jitsi
Open source repositories that support Jitsi. Jitsi Meet offers free, secure and open-source video conferencing. ⚠️ Good faith review of source that a reporter must have no association with the existence of the vulnerability in question.
Proof of Concept Requirements: ⚠️ Vulnerability submissions must include practical exploitation demonstrations on one of the following environments ▶︎ The public Jitsi Meet instance (meet.jit.si) ▶︎ 8x8 Video Meetings platform (8x8.vc) ▶︎ A self-hosted Jitsi deployment
⚠️ For E2EE submissions please consult the Jitsi End-to-End Encryption Whitepaper to better understand the implemented Threat Model.
Code Review Reports:
⚠️ Code-only vulnerabilities without proof of exploitation in production environments will typically be assessed at a lower severity level
⚠️ Vulnerabilities requiring local access to exploit will be assessed at a lower severity level (unless exceptional circumstances exist)
⚠️ Vulnerabilities exploitable only with development configurations (e.g., BYPASS_AUTHORIZATION=1) will be assessed at a lower severity level
Out of Scope: ▶︎ Not actively maintained or archived repositories ▶︎ Experimental repositories ▶︎ Reports for repositories that are forked should be submitted upstream, unless the report also affects one of our in-scope repos ▶︎ github.com/jitsi/jitsi-call-analytics ▶︎ github.com/jitsi/jitsi Jitsi Desktop is the heritage of Jitsi Meet. While some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions ▶︎ .github ▶︎ cla-enforcer ▶︎ eslint-config-jitsi ▶︎ excalidraw ▶︎ excalidraw-backend ▶︎ felix ▶︎ fmj ▶︎ go-offline-maven-plugin ▶︎ growl4j ▶︎ gsoc-ideas ▶︎ irc-api ▶︎ jebml ▶︎ jitsi-desktop-site ▶︎ jitsi-maven-repository ▶︎ jitsi-meet-file-sharing-service ▶︎ jitsi-meet-load-test ▶︎ jitsi-meet-logger ▶︎ jitsi-meet-react-sdk ▶︎ jitsi-meet-release-notes ▶︎ jitsi-meet-torture ▶︎ jitsi-pseudotcp ▶︎ jitsi-test-lab ▶︎ jitsi-videobridge-openfire-plugin ▶︎ jiwer ▶︎ jsocks ▶︎ jvb-dashboard ▶︎ jxs ▶︎ otr4j ▶︎ portaudio ▶︎ security-advisories ▶︎ Smack ▶︎ testrtc ▶︎ winrt-libs ▶︎ zrtp4j
| 8x8 Video Conferencing | The best video conferencing solution for businesses of any size. Fully secure, reliable, packed with features and ridiculously simple to use. |
|---|---|
| ⚠️ Testing accounts or credentials are not being provided at this time. | |
| ⚠️ Product Assets: |
- Web App: https://8x8.vc/
| Jitsi as a Service | World's easiest way to add video meetings to your apps. |
|---|---|
| ⚠️ Self Sign-up is available: https://jaas.8x8.vc/ | |
| ⚠️ JaaS developer portal |
| ** 8x8 Connect** | A multi-channel communication platform designed for businesses who want to work smart, not hard. |
|---|---|
| ⚠️ Self Sign-up is available: https://connect.8x8.com/ | |
| ⚠️ 8x8 CPaaS developer portal | |
| ⚠️ Product Assets: |
- Web App: https://connect.8x8.com/
- 8x8 Communication APIs: sms.8x8.com, sms.8x8.uk, sms.8x8.id, sms.us.8x8.com, chatapps.8x8.com, …
If You See Something, Say Something
We welcome and encourage any submissions that help identify potential security vulnerabilities or exposures affecting our organization. Vulnerabilities disclosed under Responsible Disclosure assets will not be eligible for bounties.
8x8 IP Ranges & Domains
8x8 subsidiaries and acquisitions
- Callroute (2026)
- Maven Lab (2026)
- In2Tel (2025)
- Fuze (2022)
- Wavecell (2019)
- Jitsi (2018)
- Quality Software Corp. (QSC) (2015)
- MarianaIQ (2015)
- DXI (2015)
- Voicenet (2013)
- Contactual (2011)
Response Targets
8x8 will make a best effort to meet the following response targets for hackers participating in our program:
- Time to first response (from report submit) - 1 business days
- Time to triage (from report submit) - 2 business days
Disclosure Policy
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Please do not discuss vulnerabilities outside of the program without proper coordination and express consent from 8x8.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
- Only interact with accounts you own or with explicit permission of the account holder. Please notify us immediately if you encounter exposure of information.
- Follow HackerOne's disclosure guidelines.
Scope Exclusions
Testing Conduct
Please do not:
- Conduct automated or high-volume testing without prior coordination
- Perform any activity that could disrupt our service (DoS/DDoS)
- Send spam or unsolicited communications
- Engage in social engineering or phishing of 8x8 staff or contractors
- Make physical attempts against 8x8 property or data centers
Mobile-Specific Exclusions
- Findings requiring a malicious or attacker-controlled application installed on the victim's device
- Same-device cross-application attacks via Android intents, activities, services, broadcast receivers, content providers, IPC mechanisms, overlays, or accessibility features
- Task hijacking (StrandHogg) vulnerabilities
- Insecure data storage on rooted or jailbroken devices
- Issues requiring local code execution in the context of another application
Common Low-Impact Issues
- Missing security headers (HSTS, CSP, SPF, DMARC, X-Frame-Options, etc.)
- Missing cookie flags (Secure, HttpOnly, SameSite) without demonstrated exploit
- SSL/TLS configuration issues (weak ciphers, key size, deprecated protocols, BEAST, CRIME)
- Software version disclosure, banner identification, or descriptive error messages
- Clickjacking on non-sensitive pages
- Self-XSS without further security impact
- CSRF on unauthenticated forms or forms with no sensitive action
- CSV injection without demonstrated impact
- Tab-nabbing
Authentication & Access Control
- Credential stuffing attacks (users are responsible for password uniqueness and enabling MFA)
- Rate limiting or brute force issues without demonstrated account compromise
- Issues requiring MITM or physical access to a user's device
Dependencies & Browsers
- Vulnerable libraries or dependencies without a demonstrated Proof of Concept showing exploitability in our application context
- Issues only affecting outdated browsers (more than 2 stable versions behind current release)
Disclosure Timing
- Public zero-day vulnerabilities patched less than 1 month ago (evaluated case-by-case)
Scanner Findings
- Low-severity issues reported by automated scanners without demonstrated security impact or exploitation path
Target Specific Scope Exclusion - connect.8x8.com
- IDORs having unguessable/non-enumerable identifier are out of scope
- IDORs in form of an UUID
- IDORs based on
AccountIdandsubAccountId
- When testing support functionality please add "HackerOne" in your subject line and limit the number of requests to an absolute minimum.
Testing Identification
- Please utilize your [username]@wearehackerone.com alias when submitting information within the applications.
- To help us identify and classify researcher traffic, 8x8 requests you to include your HackerOne username value to each and every HTTP request made by yourself or any tooling you use. Please use the following format appended to
User-Agent:X-HackerOne: [H1 username]
Safe Harbor
The Gold Standard Safe Harbor applies.
What other researchers are saying …
-
Lightning fast as always, wish all programs were like this!
-
8x8 is the best bug bounty program on HackerOne by far.
-
Best Program Team!
-
Thank you for being one of the fastest response triager as well as super transparent, someone that works with hackers just like a collaboration.
-
That was the fastest triage ever I think.
-
This is the fastest program to date. Not only is the response time is insane, but also the way your security team works with researchers is awesome. Totally love the fact that you guys are putting security as your top priority.
-
The fastest response I've seen in hackerone history, also on the weekend
-
That must be been the fastest fix I've ever seen! <24h from report to remediation, love to see it.
Thank you for helping keep 8x8 and our users safe!