• $100 – $1,500 per vulnerability
  • Partial safe harbor

Program stats

  • Vulnerabilities rewarded 20
  • Validation within 6 days 75% of submissions are accepted or rejected within 6 days
  • Average payout $500 within the last 3 months

Latest hall of famers

Recently joined this program


Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

This bounty is part of the Atlassian Marketplace Bounty Program

codefortynine builds integration applications for software development teams using Atlassian's Jira platform.

Get Started (tl;dr version)

  • Do not access, impact, destroy or otherwise negatively impact codefortynine or Atlassian customers, or customer data in any way.
  • Do not create support requests on Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program.
  • Do not post reviews for our apps on Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program.
  • Please do not test or, but install our apps in your Jira instance and test the apps themselves. Otherwise we will close your submission as "out of scope".
  • Ensure that you use your email address.
  • Ensure you understand the targets, scopes, exclusions, and rules below.
  • If you have questions, please reach out to

Quick Links

Focus Areas

Below is a list of some of the vulnerability classes that we are seeking reports for:

  • Cross Instance Data Leakage/Access**
  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Stored/Reflected Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection (SQLi)
  • XML External Entity Attacks (XXE)
  • Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
  • Path/Directory Traversal Issues

Ensure you review the out of scope and exclusions list for further details.

** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.

Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.


For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. codefortynine uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, codefortynine will defer to the CVSS score to determine the priority. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.