H1 HackerOne LIVE
Cloud Software Group
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://citrix.com
- managed triage
- no
- response efficiency
- 23%
- time to bounty
- 249h avg
17 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
accounts.cloud.com | domain | yes | critical | 2026-09-20 |
adm.cloud.com | domain | yes | critical | 2026-09-20 |
ap-s.cloud.com | domain | yes | critical | 2026-09-20 |
api.adm.cloud.com | domain | yes | critical | 2026-09-20 |
eu.cloud.com | domain | yes | critical | 2026-09-20 |
onboarding.cloud.com | domain | yes | critical | 2026-09-20 |
us.cloud.com | domain | yes | critical | 2026-09-20 |
Citrix Secure Access client for Android | mobile | yes | critical | 2026-09-20 |
Citrix Secure Access client for macOS | mobile | yes | critical | 2026-09-20 |
Citrix End Point Analysis (EPA) client for Linux | other | yes | critical | 2026-09-20 |
Citrix End Point Analysis (EPA) client for Windows | other | yes | critical | 2026-09-20 |
Citrix Secure Access client for Linux | other | yes | critical | 2026-09-20 |
Citrix Secure Access client for Windows | other | yes | critical | 2026-09-20 |
Citrix Secure Access client for iOS | other | yes | critical | 2026-09-20 |
*.citrixworkspacesapi.net | wildcard | yes | critical | 2026-09-20 |
*developer.cloud.com | wildcard | no | none | 2026-09-20 |
onboarding-*.cloud.com | wildcard | yes | critical | 2026-09-20 |
16 out of scope — black ICE, don't touch
(youriwssubdomain).cloud.comdomain(yoursubdomain).ap.iws.cloud.comdomain(yoursubdomain).eu.iws.cloud.comdomain(yoursubdomain).us.iws.cloud.comdomainaccounts-internal.cloud.comdomaincitrix.cloud.comdomainlaunch.cloud.comdomainwww.cloud.comdomain*.browser.cloud.comother*.citrix*.comwildcard*.cloudburrito.comwildcard*.podio.comwildcard*.securevdr.comwildcard*.xmdev.cloud.comwildcard*.xmqa.cloud.comwildcard*.xmtest.cloud.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.