The Atlassian Marketplace is a platform for Atlassian customers to discover, try, and buy apps which customize and extend Atlassian products. In this Vulnerability Disclosure Program (VDP), we are focused on the security of apps listed in Atlassian Marketplace. Please note that this program only encompasses apps on Atlassian Marketplace, vulnerabilities discovered in Atlassian products or services should be reported to the main Atlassian program.
All Atlassian developed Marketplace apps i.e. apps listed under Atlassian and Atlassian Labs vendor accounts participate in a separate public bug bounty program at Atlassian-Built Apps and must not be reported to VDP.
Some of the 3rd party Marketplace apps also participate in Bugcrowd bug bounty programs, read more about determining apps participation in bug bounty program here. Atlassian's Bugcrowd Landing Page provides a list of accessible vendor bug bounty programs to which you can directly report your findings and help us minimize duplicates to our program.
Note: In this program, we are mainly focused on apps that do not have Cloud Security Participant badge or apps that do not participate in Marketplace bug bounty programs. However, you can still submit your findings for apps with existing bug bounty programs and they will be accepted but considered as Not Applicable, our team reviews the submission and you may receive an invitation to join app's bounty program to resubmit there.
Researchers are highly recommended to read through our VDP instructions document for a successful acceptance and processing of a submission.
Get Started (tl;dr version)
- Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in anyway.
- Ensure that you use your @bugcrowdninja.com email address.
- Ensure you understand the targets, scopes, exclusions, and rules below.
- Information about how Atlassian apps work can be found here
Due to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for:
- Cross Instance Data Leakage/Access**
- Server-side Remote Code Execution (RCE)
- Server-Side Request Forgery (SSRF)
- Stored/Reflected Cross-site Scripting (XSS)
- Cross-site Request Forgery (CSRF)
- SQL Injection (SQLi)
- XML External Entity Attacks (XXE)
- Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
- Path/Directory Traversal Issues
- Connect App Authorization Bypass
- Shared Secret Leakage
Ensure you review the out of scope and exclusions list for further details.
** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.
Note: Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live Atlassian support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.
This program follows Bugcrowd’s standard disclosure terms.
For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email firstname.lastname@example.org. We will address your issue as soon as possible.