{"id":2255,"date":"2022-04-05T13:44:15","date_gmt":"2022-04-05T13:44:15","guid":{"rendered":"https:\/\/web2.nextcloud.com\/?page_id=2255"},"modified":"2023-01-24T12:53:44","modified_gmt":"2023-01-24T11:53:44","slug":"security","status":"publish","type":"page","link":"https:\/\/staging.nextcloud.com\/it\/security\/","title":{"rendered":"Security"},"content":{"rendered":"

[vc_section el_class=”titlebar press_releases_titlebar” css=”.vc_custom_1667984996569{background-image: url(https:\/\/nextcloud.com\/wp-content\/uploads\/2022\/11\/nextcloud-security-advisories-titlebar.jpg?id=60592) !important;}”][vc_row content_placement=”middle”][vc_column width=”1\/2″ el_class=”centerMobile”][vc_column_text el_class=”page-title”]<\/p>\n

Security and advisories<\/h1>\n

[\/vc_column_text][vc_column_text el_class=”page-subtitle”]This page hosts our security policies and information with regards to reporting security flaws.[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][\/vc_column][\/vc_row][\/vc_section][vc_section el_id=”compliant_by_design_section” el_class=”compliant_by_design_section nc_default_section” css=”.vc_custom_1667808786077{margin-bottom: 0px !important;}”][vc_row gap=”30″ content_placement=”middle”][vc_column width=”1\/2″ el_class=”centerMobile”][vc_column_text el_class=”nc_text_as_separator”]Nextcloud security[\/vc_column_text][vc_column_text]<\/p>\n

Security in Nextcloud<\/h2>\n

[\/vc_column_text][vc_column_text css=”.vc_custom_1668155545215{margin-top: 1.5rem !important;margin-bottom: 1.5rem !important;}”]Nextcloud is designed to offer the best security in the on-premises content collaboration industry. Read more about the security features and our development process.[\/vc_column_text][vc_btn title=”More about security” link=”url:%2Fsecure%2F|title:More%20about%20security” el_class=”btn-main”][\/vc_column][vc_column width=”1\/2″][vc_row_inner gap=”15″ el_class=”compliant_iconboxes”][vc_column_inner]

<\/i><\/div>\n\t

Server owners<\/h4>
For server owners, our documentation has a section with best practices and tips on securing a Nextcloud server.<\/div>Per saperne di pi\u00f9 <\/i><\/span><\/div><\/div><\/a><\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][vc_column el_class=”btns-inline-centered”][vc_btn title=”Security advisories” align=”center” i_icon_fontawesome=”fas fa-external-link-alt” add_icon=”true” link=”url:https%3A%2F%2Fgithub.com%2Fnextcloud%2Fsecurity-advisories%2Fsecurity%2Fadvisories|title:Security%20advisories|target:_blank” el_class=”btn-main”][vc_btn title=”Official CVE database” align=”center” i_icon_fontawesome=”fas fa-external-link-alt” add_icon=”true” link=”url:https%3A%2F%2Fwww.cvedetails.com%2Fvendor%2F15913%2FNextcloud.html|title:See%20a%20full%20list%20of%20historic%20advisories%20in%20the%20CVE%20database.|target:_blank” el_class=”btn-main”][vc_btn title=”Threat model” align=”center” link=”url:%2Fsecurity%2Fthreat-model|title:Threat%20model” el_class=”btn-main”][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”nc_default_section” el_id=”press-2022″ css=”.vc_custom_1667808823923{margin-top: 0px !important;}”][vc_row][vc_column][vc_column_text css=”.vc_custom_1668079566982{margin-bottom: 2rem !important;}”]<\/p>\n

Report
\na security issue<\/h2>\n

[\/vc_column_text][vc_separator color=”custom” border_width=”2″ el_width=”20″ accent_color=”#0082c9″ el_class=”nc_separator_line”][vc_column_text css=”.vc_custom_1667986091963{margin-bottom: 2rem !important;}”]<\/p>\n

If you have discovered a security issue with Nextcloud, please read our responsible
\ndisclosure guidelines and contact us at\u00a0hackerone.com\/nextcloud<\/strong><\/a>.
\nYour report should include:[\/vc_column_text][vc_row_inner gap=”25″ el_class=”iconboxes”][vc_column_inner el_class=”iconbox” width=”1\/3″][vc_icon icon_fontawesome=”fas fa-hashtag” color=”custom” align=”center” custom_color=”#0082c9″][vc_column_text el_class=”iconbox_title”]<\/p>\n

Product version<\/h4>\n

[\/vc_column_text][\/vc_column_inner][vc_column_inner el_class=”iconbox” width=”1\/3″][vc_icon icon_fontawesome=”fas fa-align-left” color=”custom” align=”center” custom_color=”#0082c9″][vc_column_text el_class=”iconbox_title”]<\/p>\n

A\u00a0vulnerability description<\/h4>\n

[\/vc_column_text][\/vc_column_inner][vc_column_inner el_class=”iconbox” width=”1\/3″][vc_icon icon_fontawesome=”fas fa-list-ol” color=”custom” align=”center” custom_color=”#0082c9″][vc_column_text el_class=”iconbox_title”]<\/p>\n

Reproduction steps<\/h4>\n

[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css=”.vc_custom_1667985711800{margin-top: 3rem !important;}”][vc_column][vc_column_text]<\/p>\n

What happens next<\/h3>\n

[\/vc_column_text][vc_row_inner equal_height=”yes” gap=”20″ el_class=”iconboxes” css=”.vc_custom_1667986169446{margin-top: 2rem !important;}”][vc_column_inner el_class=”iconbox” width=”1\/4″][vc_icon icon_fontawesome=”fas fa-check-circle” color=”custom” custom_color=”#0082c9″][vc_column_text]A member of the security team will confirm the vulnerability, determine its impact, and develop a fix.[\/vc_column_text][\/vc_column_inner][vc_column_inner el_class=”iconbox” width=”1\/4″][vc_icon icon_fontawesome=”fas fa-code-branch” color=”custom” custom_color=”#0082c9″][vc_column_text]The fix will be applied to the master branch, tested, and packaged in the next security release.[\/vc_column_text][\/vc_column_inner][vc_column_inner el_class=”iconbox” width=”1\/4″][vc_icon icon_fontawesome=”fas fa-bullhorn” color=”custom” custom_color=”#0082c9″][vc_column_text]The vulnerability will be publicly announced after the release.[\/vc_column_text][\/vc_column_inner][vc_column_inner el_class=”iconbox” width=”1\/4″][vc_icon icon_fontawesome=”fas fa-award” color=”custom” custom_color=”#0082c9″][vc_column_text]Finally, your name will be added to the\u00a0hall of fame<\/a> as a thank you from the entire Nextcloud community.[\/vc_column_text][\/vc_column_inner][vc_column_inner][vc_column_text css=”.vc_custom_1667986173450{margin-top: 2rem !important;}”]<\/p>\n

Read our threat model<\/a>\u00a0to know what is expected behavior.<\/p>\n

[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”nc_default_section lightBG” css=”.vc_custom_1667810946782{padding-top: 3rem !important;padding-bottom: 3rem !important;}”][vc_row content_placement=”middle”][vc_column][vc_column_text]<\/p>\n

PGP Key for Submissions<\/h2>\n

[\/vc_column_text][vc_separator color=”custom” border_width=”2″ el_width=”20″ accent_color=”#0082c9″ el_class=”nc_separator_line”][vc_column_text]<\/p>\n

In order to facilitate secure submission of security issues,
\nwe provide the following\u00a0PGP key<\/a>\u00a0for confidential submission:[\/vc_column_text][\/vc_column][\/vc_row][vc_row gap=”20″ equal_height=”yes” content_placement=”middle” el_class=”iconboxes”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/4″ el_class=”iconbox”][vc_icon icon_fontawesome=”fas fa-key” color=”custom” custom_color=”#0082c9″][vc_column_text el_class=”iconbox_title”]<\/p>\n

Key ID<\/h4>\n

[\/vc_column_text][vc_column_text]A724937A<\/code>[\/vc_column_text][\/vc_column][vc_column width=”1\/4″ el_class=”iconbox”][vc_icon icon_fontawesome=”fas fa-fingerprint” color=”custom” custom_color=”#0082c9″][vc_column_text el_class=”iconbox_title”]<\/p>\n

Fingerprint<\/h4>\n

[\/vc_column_text][vc_column_text]2880 6A87 8AE4 23A2 8372 792E D758 99B9 A724 937A<\/code>[\/vc_column_text][\/vc_column][vc_column width=”1\/4″][\/vc_column][vc_column][vc_column_text]<\/p>\n

We do however recommend to not encrypt the information submitted
\nvia HackerOne as only a small subset of the team has access to this key.[\/vc_column_text][\/vc_column][\/vc_row][\/vc_section][vc_section el_class=”nc_default_section” css=”.vc_custom_1667810243936{padding-top: 3rem !important;padding-bottom: 3rem !important;}”][vc_row content_placement=”middle”][vc_column width=”1\/2″][vc_column_text el_class=”nc_text_as_separator centerMobile”]Guidelines[\/vc_column_text][vc_column_text el_class=”nc-section-title”]<\/p>\n

Responsible disclosure
\nguidelines<\/h2>\n

[\/vc_column_text][vc_column_text css=”.vc_custom_1667980771923{margin-top: 2rem !important;margin-bottom: 2rem !important;}”]The Nextcloud community kindly requests that you comply with the following guidelines when researching and reporting security vulnerabilities:[\/vc_column_text][\/vc_column][vc_column width=”1\/2″][vc_column_text]<\/p>\n