8x8 Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 38, "average_time_to_first_program_response": 1, "average_time_to_report_resolved": 420, "handle": "8x8-bounty", "id": 0, "managed_program": false, "name": "8x8", "offers_bounties": true, "offers_swag": false, "response_efficiency_percentage": 100, "submission_state": "open", "url": "https://hackerone.com/8x8-bounty", "website": "https://www.8x8.com", "targets": { "in_scope": [ { "asset_identifier": "*-vpn.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**VPN Infrastructure (Palo Alto GlobalProtect)**\n▶︎ RDP: If You See Something, Say Something\n\nTesting Guidelines:\n⚠️ No attempts to exploit vulnerabilities to access internal 8x8 networks\n⚠️ No brute force or DoS testing against authentication mechanisms\n⚠️ Identical vulnerabilities affecting multiple VPN portals will be treated as a single issue. Please report once and include all affected instances.\n\nThis asset includes (but is not limited to):\n* sgc01-vpn.8x8.com\n* hk-vpn.8x8.com\n* *-vpn-contractors.8x8.com", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "*.8x8.cloud", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.co.uk", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.engineering", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.id", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.studio", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.8x8.uk", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8.vc", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Professional Meetings and Jitsi as a Service. At this time 8x8 does not provide credentials and researchers are responsible for any fees occurred if signing up for the service.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.8x8cloud.net", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8e2e.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8hosts.internal", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.8x8hosts.pilot", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.8x8pilot.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.8x8staging.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.8x8testa.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.8x8testb.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.acceptance.cloud.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "*.ai.8x8.vc", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.call-control.ie", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.cceng.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "*.chalet.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Chat provides comprehensive team messaging capabilities including 1:1 instant messaging, public and private chat rooms, file sharing, and seamless integration with voice and video calling - all designed to streamline team communications and collaboration within organizations.\n\n**Out of Scope**:\n⚠️ Third-party websites implementing 8x8 chat solutions (outside of `*.8x8.com` domains)", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.fuze.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "*.fuze.site", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "*.in2tel.ie", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.jit.si", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Jitsi is a set of open-source projects that allows you to easily build and deploy secure videoconferencing solutions. We are best known for our Jitsi Meet video conferencing platform, [meet.jit.si](https://meet.jit.si/) where we host a Jitsi Meet instance that the community can use for totally free video conferences , and the Jitsi Videobridge that powers all of our multi-party video capabilities.\n\n**Out of Scope:**\n⚠️ Application logic bugs or non-production features in [beta.meet.jit.si](https://beta.meet.jit.si/)", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.jitsi.net", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Jitsi is a set of open-source projects that allows you to easily build and deploy secure videoconferencing solutions. We are best known for our Jitsi Meet video conferencing platform.\n\n**Out of Scope:**\n⚠️ Application logic bugs or non-production features in [alpha.jitsi.net](https://alpha.jitsi.net/) or [moderated-pilot.jitsi.net](https://moderated-pilot.jitsi.net/)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.labs.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8's Vibe Platform", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "*.mavenlab.com", "asset_type": "WILDCARD", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "*.moobicast.com", "asset_type": "WILDCARD", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "*.moobidesk.com", "asset_type": "WILDCARD", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\naka: moobidesk-main.vercel.app", "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "*.ociadmin.cloud.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "*.p8t.us", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.packet8-pilot.net", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.preview.8x8.vc", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nAI Studio: Build Voice & Text AI Agents", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.prod.cloud.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.staging.cloud.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "*.thinkingphones.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.thinkingphones.net", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "*.ucverse.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.unreal-agents.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "*.unreal-agents.jitsi.net", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents (Development Environment)", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "*.wavecell.com", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "8x8 Communication APIs", "asset_type": "API", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Transform customer interactions with our seamless SMS, messaging, video, and voice solutions.\n⚠️ Self Sign-up is available: https://connect.8x8.com/\n⚠️ [8x8 CPaaS developer portal](https://developer.8x8.com/connect)\n⚠️ All APIs listed under \"8x8 Connect\" are in-scope.\n⚠️ In-Scope examples:\n * sms.8x8.com\n * chatapps.8x8.com\n * {product}.8x8.uk\n * {product}.8x8.id\n * {product}.us.8x8.com\n * {product}.{region}.cpaas-net.8x8.com", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "8x8 Partner Portal", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ https://partnerxchange.8x8.com/\n▶︎ https://8x8.my.site.com/partnerxchange/\n▶︎ https://8x8.force.com/partnerxchange/\n⚠️ out of scope: Disclosure of non-sensitive information, such as `Name`, `City`, etc.\n⚠️ out of scope: `ContentDocument` if considered non-sensitive (e.g. marketing collateral)\n⚠️ out of scope: IDORs in form of unguessable/non-enumerable identifier (UUID)", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "8x8-work", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "https://apps.apple.com/us/app/8x8-work/id348177448\n\nThe 8x8 Work app for iPhone puts your business communications in your pocket—secure voice calls, HD video meetings, and team chat, all in one beautifully streamlined app. Whether in back-to-back meetings or between coffee breaks, 8x8 Work keeps you seamlessly connected.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "8x8.my.site.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Portal for management of your 8x8 account, billing, orders, and support cases\n⚠️ when testing support functionality please add \"HackerOne\" in your subject line and limit the number of requests to an absolute minimum\n⚠️ out of scope: IDORs in form of unguessable/non-enumerable identifier (UUID)", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "ASN: AS10976", "asset_type": "OTHER", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "ASN: AS133144", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**M8X8INC-AS-AP 8x8, Inc., US**\n▶︎ RDP: If You See Something, Say Something\n\n* 103.252.162.0/24\n* 103.239.164.0/24\n* 66.81.216.0/24\n* 66.81.217.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS13896", "asset_type": "OTHER", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something\n\n* 170.76.190.0/23\n* 206.81.181.0/24\n* 103.197.98.0/23\n* 206.81.184.0/24\n* 206.81.176.0/24\n* 162.223.99.0/24\n* 170.76.188.0/23\n* 206.81.185.0/24\n* 185.155.144.0/23\n* 45.252.184.0/23\n* 185.155.146.0/23\n* 206.81.177.0/24\n* 206.81.180.0/24\n* 103.197.96.0/23\n* 162.223.97.0/24\n* 206.81.182.0/24\n* 206.81.191.0/24\n* 45.252.186.0/23\n* 162.223.96.0/24\n* 162.223.98.0/24", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "ASN: AS14294", "asset_type": "OTHER", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-FUZE, US**\nThe Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "ASN: AS198554", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**DXI-AS, GB**\n▶︎ RDP: If You See Something, Say Something\n\n* 109.70.59.0/24\n* 185.173.49.0/24\n* 185.173.48.0/22\n* 109.70.58.0/24\n* 185.173.48.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS199687", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**IN2TEL-DB3, IE**\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS206422", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**IN2TEL-BT, IE**\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS32308", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-AS, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 192.84.17.0/24\n* 216.59.140.0/24\n* 8.28.3.0/24\n* 8.28.0.0/24\n* 63.209.12.0/24\n* 8.28.2.0/24\n* 216.59.142.0/24\n* 216.59.141.0/24\n* 8.28.1.0/24\n* 162.221.239.0/24\n* 8.21.164.0/24\n* 216.59.136.0/24\n* 216.59.137.0/24\n* 192.84.18.0/24\n* 216.59.143.0/24\n* 8.25.198.0/24\n* 162.221.236.0/23\n* 192.84.16.0/24\n* 162.221.236.0/24\n* 162.221.238.0/24\n* 216.59.136.0/21\n* 192.84.16.0/22", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS395362", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-AS-1, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 8.25.218.0/24\n* 38.99.96.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS398067", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-AS-SJC01, US**\n▶︎ RDP: If You See Something, Say Something\n", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS44965", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**CONTACTUAL, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 109.70.61.0/24\n* 217.163.57.0/24\n* 66.81.220.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS46680", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**CONTACTUAL, US**\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS49856", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**EIGHT-AS, GB**\n▶︎ RDP: If You See Something, Say Something\n", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS62306", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**RO-8X8-AS, RO**\n▶︎ RDP: If You See Something, Say Something\n\n* 185.221.220.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ASN: AS62876", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "**8X8-AS-CORP, US**\n▶︎ RDP: If You See Something, Say Something\n\n* 209.94.72.0/24", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "Cloud Misconfigurations", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nAny Cloud asset & configuration owned by 8x8 is in-scope, across various Cloud providers.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Discovered Leaked Credentials", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n🚨 Testing of customer/consumer credentials is strictly prohibited\n⚠️ Researchers should submit the leaked credentials to us and must NOT test their validity beyond authenticating and then immediately deauthenticating - without exercising any functionality\n⚠️ Researchers must always include the source of where they found a leak\n⚠️ Researchers must not purchase credentials from a source that obtained them illegally\n", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "Intellectual Property on Public Domains", "asset_type": "OTHER", "availability_requirement": "none", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Leaks identified in public domains are in scope, provided they contain sensitive or proprietary information that could impact our organization’s confidentiality, integrity, or availability.", "integrity_requirement": "none", "max_severity": "critical" }, { "asset_identifier": "Third Party Application", "asset_type": "OTHER", "availability_requirement": "none", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n⚠️ Evaluation on case-by-case basis", "integrity_requirement": "none", "max_severity": "high" }, { "asset_identifier": "Virtual Office Desktop", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Download 8x8 Work for Desktop: https://support-portal.8x8.com/helpcenter/viewArticle.html?d=8bff4970-6fbf-4daf-842d-8ae9b533153d", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "admin-resolve.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 Resolve, a mobile-first critical communications and incident management solution purpose-built to reach deskless and distributed workers.", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "admin.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Administration portal for managing your 8x8 service including users and telephony features", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "analytics-*.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Analytics for Contact Center\n⚠️ shareable Wallboard links are out of scope", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "api.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "apps.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Application Panel", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "bridge.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 Community Feature Hub\n\nProduction: bridge.8x8.com\nStaging: bridge.8x8staging.com", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "callroute.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "callroute.io", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "cloud8.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "community.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\nPowered by [Higher Logic](https://support.higherlogic.com/hc/en-us/articles/12907719279380-Security-related-Support).", "integrity_requirement": "low", "max_severity": "high" }, { "asset_identifier": "connect.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "⚠️ **Temporary Scope Exclusion**: campaign.wavecell.com, contacts.8x8.com (and equivalents in other regions)\n---\n⚠️ out of scope: IDORs in form of unguessable/non-enumerable identifier (UUID)\n⚠️ out of scope: IDORs based on `AccountId` and `subAccountId`\n⚠️ when testing support functionality please add \"HackerOne\" in your subject line and limit the number of requests to an absolute minimum\n", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "converse.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 Converse. Simplify your customer service stream by unifying every messaging app conversation into a single interface.", "integrity_requirement": "high", "max_severity": "medium" }, { "asset_identifier": "dashboard.qa.ai.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Analytics for 8x8 Work", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "debug.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "developer.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nPowered by GitHub Pages.", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "fuze.me", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" }, { "asset_identifier": "http://*.packet8.net", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "https://*.chalet.8x8.com/ws/v1", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Chat provides comprehensive team messaging capabilities including 1:1 instant messaging, public and private chat rooms, file sharing, and seamless integration with voice and video calling - all designed to streamline team communications and collaboration within organizations.\n\n**Out of Scope**:\n⚠️ Third-party websites implementing 8x8 chat solutions (outside of `*.8x8.com` domains)", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "https://8x8.vc/xmpp-websocket", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "https://github.com/jitsi", "asset_type": "SOURCE_CODE", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Open source repositories that support [Jitsi](https://github.com/jitsi/).\nJitsi Meet offers free, secure and open-source video conferencing.\n⚠️ Good faith review of source that a reporter must have no association with the existence of the vulnerability in question.\n\n**Proof of Concept Requirements:**\n⚠️ Vulnerability submissions must include practical exploitation demonstrations on one of the following environments\n▶︎ The public Jitsi Meet instance ([meet.jit.si](https://meet.jit.si/))\n▶︎ 8x8 Video Meetings platform ([8x8.vc](https://8x8.vc/))\n▶︎ A self-hosted Jitsi deployment\n\n⚠️ For E2EE submissions please consult the [Jitsi End-to-End Encryption Whitepaper](https://jitsi.org/e2ee-whitepaper/) to better understand the implemented Threat Model.\n\n**Code Review Reports:**\n⚠️ Code-only vulnerabilities without proof of exploitation in production environments will typically be assessed at a lower severity level\n⚠️ Vulnerabilities requiring local access to exploit will be assessed at a lower severity level (unless exceptional circumstances exist)\n⚠️ Vulnerabilities exploitable only with development configurations (e.g., `BYPASS_AUTHORIZATION=1`) will be assessed at a lower severity level\n\n**Out of Scope:**\n▶︎ Not actively maintained or archived repositories\n▶︎ Experimental repositories\n▶︎ Reports for repositories that are forked should be submitted upstream, unless the report also affects one of our in-scope repos\n▶︎ [github.com/jitsi/jitsi-call-analytics](https://github.com/jitsi/jitsi-call-analytics)\n▶︎ [github.com/jitsi/jitsi](https://github.com/jitsi/jitsi/)\n[Jitsi Desktop](https://github.com/jitsi/jitsi/) is the heritage of [Jitsi Meet](https://github.com/jitsi/jitsi-meet). While some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions\n▶︎ [.github](https://github.com/jitsi/.github)\n▶︎ [cla-enforcer](https://github.com/jitsi/cla-enforcer)\n▶︎ [eslint-config-jitsi](https://github.com/jitsi/eslint-config-jitsi)\n▶︎ [excalidraw](https://github.com/jitsi/excalidraw)\n▶︎ [excalidraw-backend](https://github.com/jitsi/excalidraw-backend)\n▶︎ [felix](https://github.com/jitsi/felix)\n▶︎ [fmj](https://github.com/jitsi/fmj)\n▶︎ [go-offline-maven-plugin](https://github.com/jitsi/go-offline-maven-plugin)\n▶︎ [growl4j](https://github.com/jitsi/growl4j)\n▶︎ [gsoc-ideas](https://github.com/jitsi/gsoc-ideas)\n▶︎ [irc-api](https://github.com/jitsi/irc-api)\n▶︎ [jebml](https://github.com/jitsi/jebml)\n▶︎ [jitsi-desktop-site](https://github.com/jitsi/jitsi-desktop-site)\n▶︎ [jitsi-maven-repository](https://github.com/jitsi/jitsi-maven-repository)\n▶︎ [jitsi-meet-file-sharing-service](https://github.com/jitsi/jitsi-meet-file-sharing-service)\n▶︎ [jitsi-meet-load-test](https://github.com/jitsi/jitsi-meet-load-test)\n▶︎ [jitsi-meet-logger](https://github.com/jitsi/jitsi-meet-logger)\n▶︎ [jitsi-meet-react-sdk](https://github.com/jitsi/jitsi-meet-react-sdk)\n▶︎ [jitsi-meet-release-notes](https://github.com/jitsi/jitsi-meet-release-notes)\n▶︎ [jitsi-meet-torture](https://github.com/jitsi/jitsi-meet-torture)\n▶︎ [jitsi-pseudotcp](https://github.com/jitsi/jitsi-pseudotcp)\n▶︎ [jitsi-test-lab](https://github.com/jitsi/jitsi-test-lab)\n▶︎ [jitsi-videobridge-openfire-plugin](https://github.com/jitsi/jitsi-videobridge-openfire-plugin)\n▶︎ [jiwer](https://github.com/jitsi/jiwer)\n▶︎ [jsocks](https://github.com/jitsi/jsocks)\n▶︎ [jvb-dashboard](https://github.com/jitsi/jvb-dashboard)\n▶︎ [jxs](https://github.com/jitsi/jxs)\n▶︎ [otr4j](https://github.com/jitsi/otr4j)\n▶︎ [portaudio](https://github.com/jitsi/portaudio)\n▶︎ [security-advisories](https://github.com/jitsi/security-advisories)\n▶︎ [Smack](https://github.com/jitsi/Smack)\n▶︎ [testrtc](https://github.com/jitsi/testrtc)\n▶︎ [winrt-libs](https://github.com/jitsi/winrt-libs)\n▶︎ [zrtp4j](https://github.com/jitsi/zrtp4j)", "integrity_requirement": "medium", "max_severity": "low" }, { "asset_identifier": "https://webrtc.8x8.com/", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "https://www.npmjs.com/package/@8x8/pui-partner-comm", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 platform-ui package for partner integration", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "maestro.8x8.cloud", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nA CTI (Computer Telephony Integration) bridge via the Maestro SDK.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "map.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n(CPaaS) Admin Back Office Application.\n\nStaging: map.8x8staging.com\nDevelopment: map.8x8pilot.com", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "mcp.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8's MCP Catalog", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "org.vom8x8.sipua", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "8x8 Work - https://play.google.com/store/apps/details?id=org.vom8x8.sipua", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "pay.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "platform.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "platform.8x8pilot.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "pubtools.private.8x8cloud.net", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nGlobal Technical Support Enablement", "integrity_requirement": "medium", "max_severity": "high" }, { "asset_identifier": "qm-*.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Quality Management & Speech Analytics", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "resolve.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 Resolve, a mobile-first critical communications and incident management solution purpose-built to reach deskless and distributed workers.", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "sipsynergy.co.uk", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "sso.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Single Sign-On (SSO) is a session and user authentication service that permits a user to use one set of login credentials, such as name and password, to access multiple 8x8 applications.\n⚠️ MFA-bypasses requiring prior knowledge of credentials will be treated with `MEDIUM` severity.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "sso.8x8pilot.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Single Sign-On (SSO) is a session and user authentication service that permits a user to use one set of login credentials, such as name and password, to access multiple 8x8 applications.\n⚠️ MFA-bypasses requiring prior knowledge of credentials will be treated with `MEDIUM` severity.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "support-portal.8x8.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "uc.8x8pilot.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "unreal-agents.8x8pilot.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\nUnrealAgents (Staging Environment)\n(*incl. `unreal-agents-tools.8x8pilot.com` & `unreal-agents-sys.8x8pilot.com`*)", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "user-profile-staging.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "user-profile.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "vap.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "(CPaaS) Admin Back Office Application for managing voice services.\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "vcc-*.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "► Contact Center Agent Workspace:\n`./AGUI/login.php`\n► Configuration Manager:\n`./CM/login.php`\n\n⚠️ Latest version of software usually available on https://vcc-na30.8x8.com/\n⚠️ shareable Wallboard links are out of scope\n⚠️ Third-party websites implementing 8x8 chat solutions (outside of `*.8x8.com` domains) are out of scope", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "vcc-ce.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Customer Experience and Post-Call Survey Analytics\nfront-end, e.g.: https://vcc-ce.8x8.com/analytix/rt-dashboard.htm", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "video-agent.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "▶︎ RDP: If You See Something, Say Something\n\n8x8 Video Interaction revolutionizes customer engagement by enabling one-to-one video calls with our easy-to-use solution. Launch live video chats instantly—no sign-ups or downloads needed.", "integrity_requirement": "high", "max_severity": "high" }, { "asset_identifier": "voapi.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "VOAPI is a backend application responsible to process phone calls (like InboundCall, OutboundCall, Click2Dial, CallTransfer, CallMerge, Start/Stop CallRecording).\n\n▶︎ AU Region: voapi-au.8x8.com\n▶︎ UK Region: voapi-uk.8x8.com", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "work-staging.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "work.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "8x8 Work for Web, the browser-based counterpart of 8x8 Work for Desktop, enables you to collaborate efficiently with your colleagues and business contacts.\n\n⚠️ 8x8 does not provide test credentials.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "www.fuzemeeting.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "The Fuze Platform was retired on December 31, 2025.\n\n▶︎ RDP: If You See Something, Say Something", "integrity_requirement": "low", "max_severity": "low" } ], "out_of_scope": [ { "asset_identifier": "*.bell.ca", "asset_type": "WILDCARD", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "All Bell Canada domains are explicitly out of scope for testing.\nThis restriction applies to all partner and customer domains.", "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "*.msteams.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "8x8 partnership with Microsoft. All assets are owned and operated by Microsoft as part of 8x8 integration into MS Teams.", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "8x8-meeting-rooms", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "8x8 Spaces - \nhttps://apps.apple.com/us/app/8x8-meeting-rooms/id1468264023\n\nWhile some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "8x8.wavecell.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "(webmail.wavecell.com)\nPowered by [Hubspot](https://bugcrowd.com/hubspot).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "Jitsi Meet Desktop", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "https://desktop.jitsi.org/Main/Download.html\n\nJitsi Desktop is the heritage of Jitsi Meet. While some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions.", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "accountmanager.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "high", "max_severity": "none" }, { "asset_identifier": "com.atlassian.JitsiMeet.ios", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "https://apps.apple.com/us/app/jitsi-meet/id1165103905\n\nWhile some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions.", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "com.spot8x8.spot", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": "none", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "8x8 Spaces - https://play.google.com/store/apps/details?id=com.spot8x8.spot", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "express.8x8.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "feedback.wavecell.com", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Powered by [Canny](https://canny.io/security).", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "get8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "low", "max_severity": "none" }, { "asset_identifier": "http://*.callstats.io", "asset_type": "WILDCARD", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Sold to Spearline. No longer owned by 8x8.", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "http://*.contactnow.8x8.com", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "http://*.jitsi.org", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "http://*.sameroom.io", "asset_type": "WILDCARD", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "low", "max_severity": "none" }, { "asset_identifier": "investors.8x8.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "mobileidentity.8x8.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "also api.mobileidentity.8x8.com\n(more info to come soon)", "integrity_requirement": "high", "max_severity": "none" }, { "asset_identifier": "org.jitsi.meet", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "https://play.google.com/store/apps/details?id=org.jitsi.meet\n\nWhile some components are still used in e.g. Jigasi, the project is not actively developed anymore. Improvements, bugfixes and builds are entirely based on community contributions.", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "supersite.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "support.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": "low", "max_severity": "none" }, { "asset_identifier": "vm.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "www.8x8.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": "medium", "max_severity": "none" }, { "asset_identifier": "www.wavecell.com", "asset_type": "URL", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "low", "max_severity": "none" } ] } }

8x8

In scope

Recent changes

Community reports

Your notes

Out of scope