AI | Apps+ Marketplace Bug Bounty Program

Description

Apps+ builds collaborative apps for Confluence and Jira. We welcome verified security findings affecting the targets listed in this program. Before testing, read the scope: AI agents and automated tools are welcome when a human directs them, they stay within the cost and load limits, and a human verifies every finding. Unattended mass scanning, bulk submissions and unverified agent output are not. One root cause earns one bounty across all Apps+ programs; known vulnerabilities in third-party components have a 30-day bounty grace period after a patch is released; issues introduced by a new release have a 14-day grace period; and regressions are not rewarded. Ratings and rewards Initial classification uses the Bugcrowd Vulnerability Rating Taxonomy . Apps+ uses Atlassian's CVSS-based severity framework ; where the two differ, CVSS determines the final priority. Rewards follow the published ranges and scope, eligibility and duplicate rules. Priority reflects demonstrated impact and likelihood. Downgrades will include an explanation and an opportunity to appeal with evidence. Priority adjustments Apps+ adjusts priority for some issue types regardless of CVSS. These are rewarded as P4: XSS whose proof only shows script execution inside the app's sandboxed iframe. Higher priority requires demonstrating access to data or actions the attacker could not already reach. XSS blocked by Content Security Policy, unless a bypass is demonstrated. Open redirects. Issues that require site or product admin permissions to exploit. These are P5 (points only): access to licensed or paid features without a license; customer credentials found in public sources rather than exposed by an Apps+ vulnerability; findings that depend on social engineering of the victim. Vulnerability chains Submit a chain as one report. It is rewarded once, at the priority of the end-to-end impact shown in a single reproducible proof of concept; its links are not rewarded separately. A chain that depends on an excluded or out-of-scope issue (for example self-XSS, clickjacking, social engineering, prompt injection, a known issue, or a flaw in Atlassian's platform or a third-party site) is capped at P4. Chains that are described but not demonstrated are not eligible.

Targets

Scope Test only the listed in-scope apps and the Apps+-operated backend functionality they call. Other Apps+ services, internal/development systems and customer instances are out of scope. Submission eligibility A report must satisfy all of the rules below to be bounty-eligible.

1. Human validation required AI agents and automated tools may be used to test Apps+ apps, provided a human directs and supervises them, they stay within the cost and load limits below, and a human personally reproduces each finding, verifies its security impact and reviews the evidence before submitting. Unattended or mass scanning, bulk submissions and unverified scanner or agent output are prohibited, and unsupported reports are not bounty-eligible. Breaking these rules will lead to removal from Apps+ programs. Include the exact app listing, variant, hosting type, installed version, test date, account permissions, reproducible steps, expected versus actual behavior, and evidence of security impact. Put the listing URL in URL / Location of Vulnerability . Redact secrets. Scanner alerts, package versions, CVE references and model-generated claims of execution or data access are not proof. No placeholder reports: Incomplete reports, scanner alerts and claims with impact still to be confirmed do not reserve reward priority. Open report limit: Each researcher may have at most 3 Apps+ reports awaiting triage across all Apps+ programs. Further reports are closed as Not Applicable; resubmit them once your earlier reports are triaged. Unresponsive reports: If you do not answer a request for more information within 7 days, the report is closed as Not Applicable. Repeated invalid reports: Apps+ will ask Bugcrowd to remove researchers with three or more Not Applicable or out-of-scope Apps+ reports in 30 days.
2. One report per underlying vulnerability The following Confluence apps share a codebase : AI Badges , AI Buttons , AI Charts , AI Checklists , AI Code , AI Copywriter , AI Forms , AI Glossary , AI Grammar , AI Headings , AI Images , AI Labels , AI LaTeX , AI Macros , AI Photos , AI Polls , AI Sentiment , AI Summary , AI Tables , AI Tabs , AI Tags , AI Tooltips . The same underlying flaw across this family belongs in one report and is eligible for at most one bounty , not one per app. AI Autofill for Jira and AI Support for Jira are separate apps , assessed independently of this family and each other, subject to the shared code and infrastructure rule below. Reproduce the flaw in one affected app and add other affected or suspected variants to that report. You do not need source-code access or to test every listing; Apps+ will confirm whether they share the root cause. Distinct vulnerabilities may be reported separately. Similar app names or vulnerability types alone do not make findings duplicates. Shared code and infrastructure across all Apps+ programs: Apps+ runs three Bugcrowd programs (Apps, Embed and AI) on shared code and infrastructure, including api.appsplus.co. A flaw with the same root cause (the same code, library, template, configuration or Apps+ endpoint) is one vulnerability across every Apps+ app and program. It is eligible for one bounty, at the highest priority demonstrated, in the program where it was first validly reported. Reports of it in any other Apps+ program, or against another Apps+ app, are duplicates. No recycled submissions: Add evidence or appeal through the existing report. Renaming a rejected finding or submitting the same underlying flaw against another variant does not create a new issue. Internally known issues: Issues Apps+ was already tracking when you reported them, including findings from internal reviews, are duplicates. Apps+ will show the tracking date on request.
3. Publicly disclosed vulnerabilities: 30-day grace period Known vulnerabilities, including CVEs and third-party advisories, are not bounty-eligible during the first 30 calendar days after a patched version of the affected component is publicly released , even if exploitable in an Apps+ app. Do not submit them as bounty claims during this period. Early reports do not reserve future rewards or become eligible automatically. Include the advisory and the date the patched version was released. Later CVE assignments, revised advisories or new proofs of concept do not restart the clock. The rule concerns the specific disclosed flaw, not a general vulnerability class. After 30 days, demonstrate a present, reachable and exploitable path in the app. This reward rule does not extend remediation deadlines.
4. New releases: 14-day grace period Vulnerabilities introduced by a new release of an Apps+ app are not bounty-eligible during the first 14 calendar days after that release reaches production . Do not submit them as bounty claims during this period. Early reports do not reserve future rewards or become eligible automatically, and issues Apps+ fixes within those 14 days are not eligible. Apps+ determines the introducing release and its date from its deployment records.
5. Regressions are not rewarded A vulnerability that reappears after Apps+ fixed it (a regression) is a duplicate of the original issue and is not eligible for a new reward. This applies whether the original was reported through Bugcrowd or found by Apps+, and whichever release reintroduced it.
6. Latest version only Only vulnerabilities that reproduce on the latest production version of an app are eligible: the version a new installation from the Atlassian Marketplace receives. Findings that affect only an earlier version are not eligible. Access within a customer site Apps+ apps are built for everyone on the site where they are installed, and some also serve anonymous or public visitors. App data and features are shared across the site by design. Apps+ apps do not replicate Confluence page restrictions, space or project permissions, or Jira issue security inside their own data. Not eligible, including privilege escalation, IDOR or broken access control reports: Any user who can use the app reading, creating, editing or deleting app data, including data created by another user or copied into the app from content others cannot see. Reaching app features or data by calling resolvers, APIs or storage directly. Settings or views the app shows only to admins, unless they expose credentials or change a security control such as an allowlist or permission setting. Eligible, assessed by demonstrated impact: Bypassing a restriction the app itself states on data, such as data the app says only its owner or specific people can see. The app fetching Atlassian content with its own permissions and showing it to a user who cannot see it in Jira or Confluence. Anonymous visitors, guests or customer-portal users (such as Jira Service Management customers) reaching app data or actions the app offers only to licensed users of the site. Access to another site's data through in-scope Apps+-operated systems. Tenant-isolation flaws in Forge, Jira or Confluence themselves belong to Atlassian's program. Exposed credentials or tokens, impersonation of another user, or unintended code execution. Name the boundary crossed (site, Atlassian permission, user type, app-stated restriction or security control) and show the unauthorized impact. Testing rules Test only on Atlassian Cloud sites you created for this program, named bugbounty-test-.atlassian.net and registered with your @bugcrowdninja.com address, so Apps+ can separate research traffic from customer traffic. Use only accounts and data you control, and do not access, change or delete data on any site you do not own. Install the relevant in-scope app and trial/license. Test the latest production version of the app. Known or fixed issues remain subject to duplicate rules. Remain responsible for all tool and agent actions. Respect the cost and load limits below. No destructive testing, load testing, DoS/DDoS, resource exhaustion, prompt/notification/email flooding, phishing or social engineering. No unauthorized infrastructure access, pivoting or post-exploitation. Do not use one finding to seek further vulnerabilities. Use removable, minimally invasive proofs. For blind XSS, use a harmless callback. Do not collect customer data, cookies or screenshots. Stop if you encounter customer data or credentials; do not use or verify them. Ask through Bugcrowd Support before testing a payload that could be publicly visible or cannot be removed. Cost and load limits Apps+ pays per request for AI generation and per invocation on Atlassian Forge. These limits apply to every Apps+ app and Apps+-operated host, including api.appsplus.co: No fuzzing, wordlists, directory or parameter brute-forcing, dictionary scanning of resolver or function names, or unattended scanning. Agent-driven testing counts toward the limits below. At most 1 request per second and 1,000 requests per day across all Apps+ hosts. At most 20 AI generation requests (text or image) per day across all Apps+ apps, including AI runs you trigger indirectly, for example by creating issues, comments or pages. Test only through your own bugbounty-test-.atlassian.net site. Add the header X-Bugcrowd: to any request you send directly to an Apps+ host. Bypasses of authentication, billing or quota controls (for example, calling AI endpoints without a valid app installation) are in scope. Prove them in no more than 5 requests, then stop. Findings whose only impact is cost, volume or load (missing rate limits, resource use through normal app features, denial of wallet) are out of scope. Findings obtained by breaking these limits are not eligible for a reward, and Apps+ will ask Bugcrowd to remove the researcher. AI features Prompt injection is out of scope and not bounty-eligible. This includes direct and indirect prompt injection. Do not test for or submit prompt-injection findings. Changing prompts, generated text or model behavior is also out of scope. Model-generated claims of execution or data access, including hallucinated or simulated results, are not evidence of a security vulnerability. Independently demonstrated application authorization flaws, protected-data exposure or unintended code execution remain assessable under the rest of this scope. Other exclusions Flaws solely in Atlassian products/APIs/SDKs that require an Atlassian fix. Apps+-specific implementation or configuration flaws remain assessable. Non-confidential errors, stack traces, status codes, public files/banners/identifiers, or source intentionally delivered to clients without secrets. Missing security headers without demonstrated impact; flags on non-sensitive cookies; autocomplete/password saving; missing exit warnings. Clickjacking; anonymous-form/logout CSRF; CSRF requiring the victim's token; content spoofing without a security-boundary violation. CAPTCHA bypass, brute force, missing account lockout, username/email enumeration and rate-limiting reports. Enabled OPTIONS, SPF/DMARC configuration, HTTP/DNS cache poisoning and SSL/TLS configuration issues. Self-XSS or local browser/device control without a separate remote attack path; unsupported browsers; malicious-file upload/download without a separate app vulnerability. The public fetch proxy at api.appsplus.co/proxy/ is intentional. Only bypassing its guards (reaching private, internal or cloud-metadata addresses, or exposing credentials or session data) is eligible. Public endpoints Apps+ operates, including api.appsplus.co and any Forge web triggers, are public by design. Reaching them without authentication is intended. Report one only if it gives an anonymous caller data or actions they should not have, such as another site's data, someone else's files, credentials, or AI generation without a valid app installation. Identifiers and keys that are public by design: Atlassian account IDs, cloud IDs, site URLs, Forge app and environment IDs, Connect descriptors and Sentry DSNs. Errors returned when calling resolver functions an app does not define, or requests the app rejects (for example "Access denied", "Invalid input" or "Unknown operation"). Rejecting the request is the intended behaviour. Alerts, error logs, rate limiting or usage triggered in Apps+ monitoring by your testing. Legacy Atlassian Connect infrastructure on any Apps+ host, including descriptors and lifecycle or validation endpoints. An app sending content to the third-party services it uses to provide its features, such as an AI provider or an embedded service. Findings that depend on a malicious or compromised site admin, a malicious app installed alongside, or an already-compromised Atlassian account or browser. Reward administration Apps+ retains discretion to grant, modify or deny rewards under the program rules. Any tax obligations arising from a payout are the researcher's responsibility. Public Disclosure This bounty follows Bugcrowd’s standard disclosure terms. Before disclosing an issue publicly we require that you first request permission from us. Apps+ will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without Apps+'s written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Out of scope (out of scope)

Not eligible for rewards. Do not test these: Marketing, documentation and support sites: appsplus.co, www.appsplus.co, docs.appsplus.co, support.appsplus.co, go.appsplus.co Legacy Atlassian Connect hosts (deprecated; all customer installs now run on Forge): tabs.appsplus.co, broken-links.appsplus.co, countdown-timer.appsplus.co, gender-bias.appsplus.co, incoming-links.appsplus.co, panel-macro.appsplus.co, search-results.appsplus.co, shortlinks.appsplus.co, speed-reader.appsplus.co, tag-cloud.appsplus.co, update-this.appsplus.co, word-count.appsplus.co, zoom-recordings.appsplus.co Third-party services used by Apps+: Atlassian (Jira, Confluence, Forge), Cloudflare, Google, OpenAI, Zoom and Sentry. Report issues in those services to their own programs.