Atlassian Marketplace VDP

  • Safe harbor
  • Managed by Bugcrowd

We no longer offer point rewards for submissions on this program. Please refer to our blog post: How Bugcrowd sees VDPs and points for more details.

Program stats

74 vulnerabilities accepted

Validation within 6 days
75% of submissions are accepted or rejected within 6 days

Latest hall of famers

Recently joined this program

Disclosure

Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

The Atlassian Marketplace is a platform for Atlassian customers to discover, try, and buy apps which customize and extend Atlassian products. In this Vulnerability Disclosure Program (VDP), we are focused on the security of apps listed in Atlassian Marketplace. Please note that this program only encompasses apps on Atlassian Marketplace, vulnerabilities discovered in Atlassian products or services should be reported to the main Atlassian program.

All Atlassian developed Marketplace apps i.e. apps listed under Atlassian and Atlassian Labs vendor accounts participate in a separate public bug bounty program at Atlassian-Built Apps and must not be reported to VDP.

Some of the 3rd party Marketplace apps also participate in Bugcrowd bug bounty programs, read more about determining apps participation in bug bounty program here. Atlassian's Bugcrowd Landing Page provides a list of accessible vendor bug bounty programs to which you can directly report your findings and help us minimize duplicates to our program.


Note: In this program, we are mainly focused on apps that do not have Cloud Security Participant badge or apps that do not participate in Marketplace bug bounty programs. However, you can still submit your findings for apps with existing bug bounty programs and they will be accepted but considered as Not Applicable, our team reviews the submission and you may receive an invitation to join app's bounty program to resubmit there.


Reporting Instructions

Researchers are highly recommended to read through our VDP instructions document for a successful acceptance and processing of a submission.

Get Started (tl;dr version)

  • Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in anyway.
  • Ensure that you use your @bugcrowdninja.com email address.
  • Ensure you understand the targets, scopes, exclusions, and rules below.
  • Information about how Atlassian apps work can be found here

Focus Areas

Due to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for:

  • Cross Instance Data Leakage/Access**
  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Stored/Reflected Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection (SQLi)
  • XML External Entity Attacks (XXE)
  • Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
  • Path/Directory Traversal Issues
  • Connect App Authorization Bypass
  • Shared Secret Leakage

Ensure you review the out of scope and exclusions list for further details.

** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.

Note: Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live Atlassian support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.

Scope

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible.