Program Overview
Nutanix runs a vulnerability disclosure program on HackerOne. The program has 17 in-scope assets and is managed by HackerOne's triage team.
17
In-Scope Assets
16h
Avg Response
90%
Efficiency
In-Scope Assets
| Asset | Type | Max Severity | Eligible |
|---|---|---|---|
| *.nutanix.com | WILDCARD | Critical | No Bounty |
| beam.nutanix.com | URL | Critical | No Bounty |
| bootcamp.nutanix.com | URL | Critical | No Bounty |
| cpq.nutanix.com | URL | Critical | No Bounty |
| gp.nutanix.com | URL | Critical | No Bounty |
| idp.nutanix.com | URL | Critical | No Bounty |
| install.nutanix.com | URL | Critical | No Bounty |
| iot.nutanix.com | URL | Critical | No Bounty |
| jira.nutanix.com | URL | Critical | No Bounty |
| my.nutanix.com | URL | Critical | No Bounty |
| nutanix.com | URL | Critical | No Bounty |
| productsizer.nutanix.com | URL | Critical | No Bounty |
| stage-billing.nutanix.com | URL | Critical | No Bounty |
| support.nutanix.com | URL | Critical | No Bounty |
| testdrive.nutanix.com | URL | High | No Bounty |
| ticket.nutanix.com | URL | Critical | No Bounty |
| www.nutanix.dev | URL | High | No Bounty |
Out-of-Scope Assets
- events.nutanix.com
- frame.nutanix.com
- karbon.nutanix.com
- mops.nutanix.com
- next.nutanix.com
- webex.nutanix.com
Tips for Hacking Nutanix
- Read the policy — Understand what's in scope, out of scope, and any specific testing restrictions before you start.
- Enumerate the attack surface — Use subdomain enumeration and directory bruteforcing to map all accessible endpoints.
- Focus on high-impact bugs — Look for SQL injection, SSRF, and IDOR vulnerabilities first.
- Test authentication flows — Check for OAuth misconfigurations and CSRF in login/signup flows.
- Write clear reports — Include steps to reproduce, impact assessment, and suggested remediation. Use Burp Suite to capture evidence.
Frequently Asked Questions
How do I start hacking Nutanix?
Sign up on HackerOne, read the program policy carefully, review the in-scope assets listed above, and start testing. Always stay within scope and follow responsible disclosure guidelines.
Does Nutanix pay bounties?
No, Nutanix runs a Vulnerability Disclosure Program (VDP) without monetary rewards. You may receive recognition or swag.
What types of vulnerabilities does Nutanix accept?
Nutanix accepts reports for vulnerabilities found in their 17 in-scope assets. Common accepted vulnerability types include XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE. Check the program policy for specific exclusions.