Atlassian-Built Apps

  • $100 – $3,000 per vulnerability

Program stats

  • Vulnerabilities rewarded 138
  • Validation within 15 days 75% of submissions are accepted or rejected within 15 days
  • Average payout $250 within the last 3 months

Latest hall of famers

Recently joined this program

87 total

This bounty is part of the Atlassian Marketplace Bounty Program

The Atlassian Marketplace is a one-stop shop for apps that custom fit Atlassian products to the unique needs of every team. In this bounty program we are focused on the security of the Marketplace apps created and developed by Atlassian.

Please note that this program encompasses only the official Atlassian developed Marketplace apps and apps made by Trello. Vulnerabilities discovered in Atlassian products or services should be reported to the main Atlassian program.

Vulnerabilities discovered in third party Marketplace apps (apps not developed by Atlassian) can be reported and we will forward such reports to the creators of the app or we will invite you to the app vendors bug bounty program if they have one, but we may not guarantee the eligibility for a reward.

Note: Atlassian's Bugcrowd Landing Page provides a list of accessible vendor bug bounty programs to which you can directly report your third party app findings.

Get Started (tl;dr version)

  • Do not access, impact, destroy or otherwise negatively affect Atlassian customers, or customer data in any way.
  • Ensure that you use your @bugcrowdninja.com email address.
  • Ensure you understand the targets, scopes, exclusions, and rules below.
  • Information about how Atlassian apps work can be found here

Focus Areas

Due to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for:

  • Cross Instance Data Leakage/Access**
  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Stored/Reflected Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection (SQLi)
  • XML External Entity Attacks (XXE)
  • Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
  • Path/Directory Traversal Issues
  • Connect App Authorization Bypass
  • Shared Secret Leakage

Ensure you review the out of scope and exclusions list for further details.

** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.

Note: Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live Atlassian support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.

Rewards

Any finding that is not listed as in scope can still be reported via this program. These reports will be rewarded at the discretion of the Atlassian Security Team.

Note: Atlassian uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.