Atlassian-Built Apps

  • $100 – $3,000 per vulnerability
  • Safe harbor
  • Managed by Bugcrowd

Program stats

101 vulnerabilities rewarded

Validation within 12 days
75% of submissions are accepted or rejected within 12 days

$460.71 average payout (last 3 months)

Latest hall of famers

Recently joined this program

Disclosure

Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

This bounty is part of the Atlassian Marketplace Bounty Program

The Atlassian Marketplace is a one-stop shop for apps that custom fit Atlassian products to the unique needs of every team. In this bounty program we are focused on the security of the Marketplace apps created and developed by Atlassian.

Please note that this program encompasses only the official Atlassian Marketplace apps, Atlassian Labs and apps made by Trello. Vulnerabilities discovered in other Atlassian products or services should be reported to the main Atlassian program.

Vulnerabilities discovered in third party Marketplace apps are likewise not the in scope of this program. You can report any third party app vulnerabilities to our Marketplace VDP program or we will forward such reports to the creators of the app, but they will not be eligible for a reward.

Note: Atlassian's Bugcrowd Landing Page provides a list of accessible vendor bug bounty programs to which you can directly report your third party app findings.

Get Started (tl;dr version)

  • Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in any way.
  • Ensure that you use your @bugcrowdninja.com email address.
  • Ensure you understand the targets, scopes, exclusions, and rules below.
  • Information about how Atlassian apps work can be found here

Focus Areas

Due to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for:

  • Cross Instance Data Leakage/Access**
  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Stored/Reflected Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection (SQLi)
  • XML External Entity Attacks (XXE)
  • Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
  • Path/Directory Traversal Issues
  • Connect App Authorization Bypass
  • Shared Secret Leakage

Ensure you review the out of scope and exclusions list for further details.

** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.

Note: Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live Atlassian support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.

Rewards

Any finding that is not listed as in scope can still be reported via this program. These reports will be rewarded as kudos only reports - any payout is at the discretion of the Atlassian Security Team.

All In-Scope submissions that are deemed valid, unique and having a security impact will be rewarded with the following scale:

Preinstalled Apps

Priority All In-scope Targets
P1 $3000
P2 $1800
P3 $600
P4 $200

Atlassian Apps

Priority All In-scope Targets
P1 $1,500
P2 $900
P3 $300
P4 $100

Trello Power Ups

Priority All In-scope Targets
P1 $1,500
P2 $900
P3 $300
P4 $100

Note: Atlassian uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.