Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Atlassian bug bounty programs

atlassian.com Updated

Atlassian runs two public programs: a Bugcrowd bug bounty paying up to $12,000 and a self-hosted bug bounty. 3 companies it owns, including Trello and Statuspage, run 3 more programs.

Top reward
$12,000
Bugcrowd
Programs
5
5 pay cash
Targets in scope
74
7 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs Atlassian runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Atlassian

Bugcrowd · The company-wide program. Pays up to $12,000.
  • Atlassian

    Bugcrowd · Bug bounty

    Open

    Top reward

    $12k
    Critical
    $12k (highest)
    High
    $6,000 (highest)
    Medium
    $325 (highest)
    Low
    $250 (highest)
    Safe harbor
    Full
  • Atlassian

    Self-hosted · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Full

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies Atlassian owns

3 companies with 3 programs of their own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

74 targets across all 5 programs, each listed once with the programs that cover it. 17 excluded.

  • Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance

    Wildcards

    Covered by Atlassian

  • https://*.atlastunnel.com

    Wildcards

    Covered by Atlassian

  • *.opsgenie.com

    Wildcards

    Covered by Opsgenie

  • *.statuspage.io

    Wildcards

    Covered by Statuspage

  • *.trello.services

    Wildcards

    Covered by Trello

  • atlassian.com

    Domains

    Covered by Self-hosted

  • api.trello.com

    Web

    Covered by Trello

  • https://admin.atlassian.com

    Web

    Covered by Atlassian

  • https://admin.atlassian.com/atlassian-guard

    Web

    Covered by Atlassian

  • https://app.opsgenie.com

    Web

    Covered by Opsgenie

  • https://bitbucket.org

    Web

    Covered by Atlassian

  • https://butlerfortrello.com

    Web

    Covered by Trello

  • https://id.atlassian.com/login

    Web

    Covered by Atlassian

  • https://manage.statuspage.io

    Web

    Covered by Statuspage

  • https://marketplace.atlassian.com

    Web

    Covered by Atlassian

  • https://mobileapp.opsgenie.com

    Web

    Covered by Opsgenie

  • https://start.atlassian.com

    Web

    Covered by Atlassian

  • https://trello.com/power-ups/55a5d917446f517774210011/calendar-power-up

    Web

    Covered by Trello

  • https://trello.com/power-ups/55a5d917446f517774210012/card-aging

    Web

    Covered by Trello

  • https://trello.com/power-ups/55a5d917446f517774210013/voting

    Web

    Covered by Trello

  • https://trello.com/power-ups/5c2462c384ab8949b1724a20/list-limits

    Web

    Covered by Trello

  • https://trello.com/power-ups/6052d130068a8c0de7b022b4

    Web

    Covered by Trello

  • https://www.atlassian.com/enterprise/data-center/bitbucket

    Web

    Covered by Atlassian

  • https://www.atlassian.com/enterprise/data-center/crowd

    Web

    Covered by Atlassian

  • https://www.atlassian.com/enterprise/data-center/jira

    Web

    Covered by Atlassian

No target matches. Try part of a host name, such as the company name.

Out of scope 17

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.bitbucket.io

    Atlassian

  • Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of <customer>.atlassian.net or <customer>.jira.com. Test only your own instances.

    Atlassian

  • Any internal or development services.

    Opsgenie Atlassian

  • Any repository that you are not an owner of - do not impact Atlassian customers in any way.

    Atlassian

  • bytebucket.org

    Atlassian

  • e.trello.com

    Trello

  • help.trello.com

    Trello

  • http://bugcrowd.com/atlassianapps

    Trello Atlassian

  • https://blog.bitbucket.org

    Atlassian

  • https://info.loom.com

    Atlassian

  • https://shop.atlassian.com

    Atlassian

  • https://support.atlassian.com

    Atlassian

  • https://support.loom.com

    Atlassian

  • Opsgenie Production (billing systems, third parties)

    Opsgenie

  • trello-attachments.s3.amazonaws.com

    Trello

  • HipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile)

    Atlassian

  • Stride (inc. Stride Video, Stride Desktop, Stride Mobile)

    Atlassian

Recent changes

Reward and scope changes across every Atlassian program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Atlassian products, from the NVD.

Search NVD
  • CVE-2026-21589 Critical

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledg

  • CVE-2026-21589 Critical

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledg

  • CVE-2026-21584 High

    This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information

  • CVE-2026-21584 High

    This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information

  • CVE-2026-21577 High

    This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a h

  • CVE-2026-21579 High

    This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability. Atlassian recommends that Conflue

  • CVE-2026-21575 High

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interact

  • CVE-2026-21575 High

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interact

About this page

This page gathers every public program listed under atlassian.com and the companies Atlassian owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Atlassian.

Something wrong or missing? Report a correction.