Nextiva Vulnerability Disclosure

generated: '2026-07-31'
method: searched
probe: true
source: https://www.nextiva.com/security-policy.html
policy:
- https://www.nextiva.com/security-policy.html
contact:
- security@nextiva.com
program:
  type: responsible-disclosure
  intake: web form on the security policy page, plus security@nextiva.com
  platform: Bugcrowd
  platform_note: >-
    The published policy directs researchers to Bugcrowd regarding access to
    private programs Nextiva may be running on its applications. No public
    Bugcrowd or HackerOne program page for Nextiva was found from an anonymous
    probe.
  rewards: >-
    Described as a "points-only" program, with P1 submissions rewarded at $1,000
    on a case-by-case basis.
  prohibited:
  - unauthorized access to customer or employee data
  - denial of service testing
  - malware
  - spam / social engineering testing
  - testing third-party applications
  - public disclosure without written consent
security_txt:
  published: false
  probed:
  - {url: 'https://www.nextiva.com/.well-known/security.txt', status: 404}
  - {url: 'https://api.nextiva.com/.well-known/security.txt', status: 404}
  gap: >-
    Nextiva runs a real disclosure program but does not advertise it via an RFC
    9116 /.well-known/security.txt, so automated discovery misses it.
evidence:
- source: https://www.nextiva.com/security-policy.html
  kind: security-policy-page
  fetched: '2026-07-31'
  http_status: 200
  keywords: [responsible disclosure, security@nextiva.com, Bugcrowd, P1, prohibited activities]