• $100 – $1,500 per vulnerability
  • Partial safe harbor

Program stats

  • Vulnerabilities rewarded 23
  • Validation within 4 days 75% of submissions are accepted or rejected within 4 days

Latest hall of famers

Recently joined this program

277 total


Please note: This program or engagement does not allow disclosure. You may not release information about vulnerabilities found in this program or engagement to the public.

This bounty is part of the Atlassian Marketplace Bounty Program

Analyze and visualize your Jira and Confluence data with just a few clicks.

Get Started

  • Do not access, impact, destroy or otherwise negatively impact eazyBI SIA or Atlassian customers, or customer data in any way.
  • Ensure that you use your @bugcrowdninja.com email address.
  • Ensure you understand the targets, scopes, exclusions, and rules below. ​

Quick Links

You can follow the links here to the targets of the eazyBI program:

IMPORTANT. The links to targets (except the Documentation) are the location where you can access the eazyBI app from the Atlassian Marketplace. Please, refrain from affecting the listing of the eazyBI app on the Marketplace (e.g. by posting reviews) as it is not in the scope of this program.

Focus Areas

We're more interested in traditional web application vulnerabilities. Below is a list of some of the vulnerability classes that we are seeking reports for:

  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Stored/Reflected Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection (SQLi)
  • HTML injection
  • Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
  • Path/Directory Traversal Issues ​

Ensure you review the out of scope and exclusions list for further details.

Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.


For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Please see below for deviations.

Note: eazyBI uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, eazyBI will defer to the CVSS score to determine the priority.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please submit through the Bugcrowd Support Portal. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.