Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Atlassian-Built Apps

By Atlassian Bug bounty on Bugcrowd

Accepting reports Full safe harbor
Go to program
Top reward
$4,000
Top severity paid
Critical
Assets in scope
119
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $4,000
for critical bugs, from $100.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $4,000 from $1,800
High $1,500 from $1,000
Medium $250 from $175
Low $175 from $100
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $4,000

Scope

119 assets you may test, 6 excluded.

Web 1

  • Third Party Marketplace Apps

Products and areas 118

  • https://marketplace.atlassian.com/apps/1210992/atlassian-plugin-sdk-deb?hosting=cloud
  • https://marketplace.atlassian.com/apps/1211203/bitbucket-server-protect-unmerged-hook?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1211246/autolink-plugin-for-jira?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1211449/auto-unapprove-for-bitbucket-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1211596/whos-looking-for-jira-cloud?hosting=cloud
  • https://marketplace.atlassian.com/apps/1211644/questions-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1211644/questions-for-confluence?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1212136/advanced-roadmaps-formerly-portfolio?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1212137/insight-asset-management?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1212632/look-and-feel-for-bitbucket-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1212778/my-reminders-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214351/disable-referer-for-bitbucket-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1214509/entity-property-tool-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214527/javascript-charts-for-jira-cloud?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214632/rich-text-gadget-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214668/insight-discovery?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214668/insight-discovery?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1214757/hackathon-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1214912/better-code-macro-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1215460/automation-for-jira-data-center-and-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1215460/automation-for-jira-server?hosting=cloud
  • https://marketplace.atlassian.com/apps/1215795/analytics-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1215833/proforma-forms-checklist-for-jira?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1216074/insight-macro-for-confluence?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1216079/statuspage-for-jira-service-management?hosting=cloud
  • https://marketplace.atlassian.com/apps/1216079/statuspage-for-jira-service-management?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1216096/sso-for-atlassian-server-and-data-center?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1216863/jira-cloud-for-slack-official?hosting=cloud&tab=overview
  • https://marketplace.atlassian.com/apps/1217696/troubleshooting-and-support-jira?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217697/troubleshooting-and-support-confluence?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217745/troubleshooting-and-support-bamboo?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217750/insight-jira-bitbucket-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217751/insight-tempo-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217836/microsoft-teams-for-jira?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1217941/permission-lockdown-for-bitbucket-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1218117/ipython-notebook-viewer?hosting=cloud
  • https://marketplace.atlassian.com/apps/1218250/mobile-plugin-for-confluence-data-center-and-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1218757/insight-aws-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1218781/bitbucket-cloud-for-slack-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1218974/insight-azure-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219094/insight-sccm-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219212/insight-google-cloud-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219298/insight-snow-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219518/confluence-cloud-for-slack-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1219561/insight-servicenow-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219592/github-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1219632/insight-device42-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219672/confluence-cloud-migration-assistant?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1219908/insight-jamf-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220099/jira-server-for-slack-official?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220151/mobile-plugin-for-jira-data-center-and-server?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220186/confluence-server-for-slack-official?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220353/insight-nvd-integration?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220382/jira-cloud-for-google-sheets-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1220666/jira-cloud-for-outlook-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1220729/bitbucket-server-for-slack-official?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220745/centralized-license-visibility?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1220820/bitbucket-pipelines-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1221237/advanced-roadmaps-for-jira-in-confluence?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1221251/opsgenie-incident-timeline?hosting=cloud
  • https://marketplace.atlassian.com/apps/1221301/jira-cloud-for-excel-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1221312/opsgenie-incident-timeline-eu?hosting=cloud
  • https://marketplace.atlassian.com/apps/1222010/jira-cloud-migration-assistant?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1222147/opsgenie?hosting=cloud
  • https://marketplace.atlassian.com/apps/1223382/previous-next-navigation?hosting=cloud
  • https://marketplace.atlassian.com/apps/1225664/form-macro-builder-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1226127/confluence-cloud-for-microsoft-teams?hosting=cloud
  • https://marketplace.atlassian.com/apps/1226380/decisions-helper-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1226478/jira-cloud-for-microsoft-teams?hosting=cloud
  • https://marketplace.atlassian.com/apps/1226610/bitbucket-cloud-migration-assistant?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1227791/jenkins-for-jira-official?hosting=cloud
  • https://marketplace.atlassian.com/apps/1227901/application-tunnels?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1227949/hackathon-workflow-alan?hosting=cloud
  • https://marketplace.atlassian.com/apps/1227949/hackathon-workflow-alan?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1228937/atlas-for-jira-cloud?hosting=cloud&tab=overview
  • https://marketplace.atlassian.com/apps/1229343/developer-assistant-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1229446/developer-assistant-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1230032/databricks-visualization?hosting=cloud
  • https://marketplace.atlassian.com/apps/1230671/extension-point-finder-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1230672/extension-point-finder-for-jira?hosting=cloud
  • https://marketplace.atlassian.com/apps/1231916/issue-status-helper?hosting=cloud
  • https://marketplace.atlassian.com/apps/1231985/localised-date-macro-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1232254/bump-build-number?hosting=datacenter
  • https://marketplace.atlassian.com/apps/1232285/jira-confluence-smart-chips-for-google-docs-slides-sheets?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1232506/jsm-assets-microsoft-entra-id-azure-ad-beta-integration?hosting=cloud
  • https://marketplace.atlassian.com/apps/1232793/azure-devops-for-jira-official?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1232887/mermaid-diagrams-viewer?hosting=cloud
  • https://marketplace.atlassian.com/apps/1233346/audio-recorder-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1233931/snyk-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1233942/pagerduty-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1233977/sentry-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1233986/slack-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1233993/gitlab-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1234004/bitbucket-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1234027/github-for-compass?tab=overview&hosting=cloud
  • https://marketplace.atlassian.com/apps/1234673/jsm-incident-timeline?hosting=cloud
  • https://marketplace.atlassian.com/apps/1234690/data-manager-clients-for-jsm-assets?hosting=cloud
  • https://marketplace.atlassian.com/apps/1235122/event-sign-up-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/1235488/confluence-widget-for-figma-beta?hosting=cloud
  • https://marketplace.atlassian.com/apps/1235496/jira-board-buddy?hosting=cloud
  • https://marketplace.atlassian.com/apps/23915/atlassian-universal-plugin-manager?hosting=datacenter
  • https://marketplace.atlassian.com/apps/5142/toolkit-plugin-for-jira?hosting=datacenter
  • https://marketplace.atlassian.com/apps/72307/team-calendars-for-confluence?hosting=cloud
  • https://marketplace.atlassian.com/apps/72307/team-calendars-for-confluence?hosting=datacenter
  • https://trello.com/power-ups/55a5d915446f517774210001/box
  • https://trello.com/power-ups/55a5d915446f517774210003/evernote
  • https://trello.com/power-ups/55a5d916446f517774210004/github
  • https://trello.com/power-ups/55a5d916446f517774210006/google-drive
  • https://trello.com/power-ups/55a5d917446f517774210009/salesforce
  • https://trello.com/power-ups/55a5d917446f51777421000a/slack
  • https://trello.com/power-ups/55a5d917446f51777421000c/mailchimp
  • https://trello.com/power-ups/55a5d917446f51777421000d/package-tracker
  • https://trello.com/power-ups/56940ede94fd60cf95f7ce6a/zendesk
  • https://trello.com/power-ups/57b47fb862d25a30298459b1/card-repeater
  • https://trello.com/power-ups/58dd18bdccfca7af8311792e/card-snooze
  • https://trello.com/power-ups/5940440775fbe327abd3329f/onedrive
  • https://trello.com/power-ups/5a2de0c41ae4a1537bb0055d/read-me
  • https://trello.com/power-ups/6048e897c73d032a983e2a7c/dashcards
Out of scope (6)
  • https://trello.com/power-ups/*
  • https://marketplace.atlassian.com (website)
  • https://trello.com/power-ups/55a5d917446f517774210011/calendar-power-up
  • https://trello.com/power-ups/55a5d917446f517774210012/card-aging
  • https://trello.com/power-ups/55a5d917446f517774210013/voting
  • https://trello.com/power-ups/5c2462c384ab8949b1724a20/list-limits

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Atlassian-Built Apps (via Bugcrowd)'s policy.

While testing

  • Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in any way.
  • Ensure that you use your @bugcrowdninja.com email address.
  • Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance".
  • Use of any automated tools/scanners is strictly prohibited and will lead to you being removed from the program
  • Reports need to be submitted in plain text
  • Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure.
  • Do NOT test the physical security of Atlassian offices, employees, equipment, etc.
  • No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program.

Not accepted

  • Lack of Rate Limiting on any of the targets.
  • The use of Automated scanners is strictly prohibited
  • Descriptive error messages (e.g. Stack Traces, application or server errors).
  • Fingerprinting / banner disclosure on common/public services.
  • Clickjacking and issues only exploitable through clickjacking.
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Content Spoofing.
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • Lack of Security Speedbump when leaving the site.
  • Weak Captcha / Captcha Bypass.
  • Login or Forgot Password page brute force and account lockout not enforced.
  • Username / email enumeration.
  • Missing HTTP security headers
  • HTTP/DNS cache poisoning.
  • SSL/TLS Issues
  • Self-XSS reports will not be accepted.
  • Vulnerabilities that are limited to unsupported browsers will not be accepted
  • Known vulnerabilities in used libraries
  • Missing or incorrect SPF records of any kind.
  • Missing or incorrect DMARC records of any kind.
  • Source code disclosure vulnerabilities.
  • Information disclosure of non-confidential information
  • The ability to upload/download viruses or malicious files to the platform.
  • Email bombing/Flooding/rate limiting.

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 27 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://marketplace.atlassian.com (Website) (out of scope)

  2. Scope added

    https://trello.com/power-ups/55a5d917446f517774210013/voting (out of scope)

  3. Scope added

    Third Party Marketplace Apps

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

This bounty is part of the Atlassian Marketplace Bounty Program The Atlassian Marketplace is a one-stop shop for apps that custom fit Atlassian products to the unique needs of every team. In this bounty program we are focused on the security of the Marketplace apps created and developed by Atlassian. Please note that this program encompasses only the official Atlassian developed Marketplace apps and apps made by Trello . Vulnerabilities discovered in Atlassian products or services should be reported to the main Atlassian program . Vulnerabilities discovered in third party Marketplace apps (apps not developed by Atlassian) can be reported and we will forward such reports to the creators of the app or we will invite you to the app vendors bug bounty program if they have one, but we may not guarantee the eligibility for a reward. Note: Atlassian's Bugcrowd Landing Page provides a list of accessible vendor bug bounty programs to which you can directly report your third party app findings. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Information about how Atlassian apps work can be found here Focus Areas Due to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Connect App Authorization Bypass Shared Secret Leakage Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Note: Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live Atlassian support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs. Rewards Any finding that is not listed as in scope can still be reported via this program. These reports will be rewarded at the discretion of the Atlassian Security Team. Note: Atlassian uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority.

Targets

Rules, Exclusions, and Scopes Any domain/property of Atlassian not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). Researchers should use the "bugbounty-test-.atlassian.net" namespace provided in the instructions below. Please do not create additional instances outside of this namespace for testing. Note: If the same vulnerability exists in different hosting solutions of a single app, we may pay for this vulnerability once if the codebase and the fix is the same. We reserve the right to make this decision on a case by case basis. Additionally, there are apps that have distinct listings but share the same codebase. In such case we will only pay once across these apps, unless an environmentally unique vulnerability is discovered. One example is Opsgenie Incident Timeline and Opsgenie Incident Timeline EU. Both apps have the same codebase, they are just hosted in different regions. Creating Your Instance You will need to first set up a product instance where you can install target apps. Please visit this page to get started with the product of your choice and follow the instructions provided. When registering for a cloud product, please use your @bugcrowdninja.com email address and the following format for the subdomain: bugbounty-test- . Note that should be replaced with your own bugcrowd username. Out-of-Scope Anything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However to help avoid grey areas, below are examples of what is considered out of scope. Identifying apps which are installed, as long as the user level has access to the instance, is known as part of the Atlassian Connect threat model, and is an accepted risk. Please do not report this. Enumeration or information disclosure of non-sensitive information (e.g. issue keys, project keys, commit hashes). JWT transmitted in the URL is a known issue and will be addressed on a platform level. Blind XSS must not return any user data that you do not have access to (e.g. Screen shots, cookies that aren't owned by you, etc); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your webserver, etc). XSSs on Server instances that require administrator privileges will be scored as P5 Informational and awarded points only, as they don't let the attacker compromise Confidentiality, Integrity or Availability any more than they already could as an administrator. When testing, please exercise caution if injecting on any form that may be publicly visible - such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with support@bugcrowd before performing the testing. No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues. Any Atlassian website (e.g. www.atlassian.com) is out of scope for this bounty unless it is directly accessible from one of the targets or any associated services attached to the instance. Customer cloud instances and data are explicitly out of scope. Any repository that you are not an owner of - do not impact Atlassian customers in any way. Any Atlassian billing system. However, specific endpoints that are used inside of a target are in scope. For example, if a REST endpoint is proven to be called from one of the targets, then that endpoint is considered to be in scope. However, all other endpoints are not considered to be in scope, as they are not called from the instance at any stage. Any internal or development services. The following finding types are specifically excluded from the bounty Lack of Rate Limiting on any of the targets. The use of Automated scanners is strictly prohibited (we have these tools too - don't even think about using them) Descriptive error messages (e.g. Stack Traces, application or server errors). Fingerprinting / banner disclosure on common/public services. Clickjacking and issues only exploitable through clickjacking. Logout Cross-Site Request Forgery (logout CSRF). Content Spoofing. Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Lack of Security Speedbump when leaving the site. Weak Captcha / Captcha Bypass. Login or Forgot Password page brute force and account lockout not enforced. Username / email enumeration. Missing HTTP security headers, specifically ( https://owasp.org/www-project-secure-headers/ ), e.g. Strict-Transport-Security. X-Frame-Options. X-XSS-Protection. X-Content-Type-Options. Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP. Content-Security-Policy-Report-Only. Cache-Control and Pragma HTTP/DNS cache poisoning. SSL/TLS Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack. SSL Forward secrecy not enabled. SSL weak/insecure cipher suites. Self-XSS reports will not be accepted. Similarly, any XSS where local access is required (i.e. User-Agent Header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will allow for the XSS to trigger. Vulnerabilities that are limited to unsupported browsers will not be accepted (i.e. "this exploit only works in IE6/IE7"). A list of supported browsers can be found here . Known vulnerabilities in used libraries, or the reports that an Atlassian product uses an outdated third party library (e.g. jQuery, Apache HttpComponents etc) unless you can prove exploitability. Missing or incorrect SPF records of any kind. Missing or incorrect DMARC records of any kind. Source code disclosure vulnerabilities. Information disclosure of non-confidential information (e. g. issue id, project id, commit hashes). The ability to upload/download viruses or malicious files to the platform. Email bombing/Flooding/rate limiting. JWT in ajax requests ignores path and HTTP method. For some of our apps, we allow arbitrary HTML templates to be defined by administrators. Those could potentially be used for XSS attacks, however since only administrators have access we don't consider those as security threats. Rules You must ensure that customer data is not affected in any way as a result of your testing. Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under “Creating your instance” above. In addition to above, customer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or "verified") If you believe you have found sensitive customer data (e.g., login credentials, API keys etc) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works. If you find Atlassian Employee login credentials, API keys etc, please report it, but do not attempt to successfully validate if/that it works. Use of any automated tools/scanners is strictly prohibited and will lead to you being removed from the program (trust us, we have those tools too). Reports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text. Grants/awards are at the discretion of Atlassian and we withhold the right to grant, modify or deny grants. But we'll be fair about it. Tax implications of any payouts are the sole responsibility of the reporter. Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure. Do NOT test the physical security of Atlassian offices, employees, equipment, etc. This bounty follows Bugcrowd’s standard disclosure terms. Any vulnerability found in a Jira or Confluence server product is not eligible for a reward in Jira/Confluence cloud, and vice versa (i.e. no double dipping). Scoring A few issue types are not scored by their CVSS scores These are typically CVSS Medium (P3) but will be rewarded as P4 issues: Open Redirect bugs, and Broken Access Control or Privilege Escalation bugs, where an Administrator is able to perform System Administrator actions. Public Disclosure Before disclosing an issue publicly we require that you first request permission from us. Atlassian will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without Atlassian's written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Preinstalled Apps in Jira and Confluence (in scope)

Some Connect apps are installed by default in all cloud instances of Confluence and Jira. These apps are referred to as Preinstalled/System apps. These apps are restricted to site-admins of the instance and cannot be deleted as they are integral parts of the system. Note: Not all target apps listed below have a Marketplace listing, please use these instructions on how to find a preinstalled/system app on Jira or Confluence instance if the target app is hidden on marketplace.

Trello Power Ups (Made by Trello) (in scope)

Trello Power Ups allow you to bring additional features to Trello boards and integrate your favorite apps right into Trello. They can pull information and data from outside services directly into Trello. Only power ups made by Trello listed here are inscope for this program. Note: Please report Calendar , Card aging , List Limits , Voting Power Ups to our Trello main program .

Third Party Marketplace Apps (in scope)

Third Party Marketplace apps are apps not developed by Atlassian and do not follow the normal bug bounty security assessment and processing. However, vulnerabilities discovered in third party Marketplace apps can be reported and we will make attempts to forward such reports to the creators of the app or we will invite you to the app vendors bug bounty program if they have one. We do not guarantee the eligibility for a reward. Rewards may be considered on a case by case basis for P1 findings of critical security impact. Atlassian holds the right to eliminate rewards or acceptance of these reports at any given time.