{"id":"c31ec9fd-9fff-4aa1-9b4e-aa9929f1086a","engagementId":"d5e162c9-4d2f-47e7-b8f4-f8dcbde936f9","data":{"brief":{"id":"60147d4b-f976-4a45-9cf8-b4c06769455d","name":"Atlassian","tagline":"Collaboration tools for teams of all sizes","description":"\u003ch3\u003e\u003cem\u003eTools for teams, from startup to enterprise. Atlassian provides the tools to help every team unleash their full potential.\u003c/em\u003e\u003c/h3\u003e\n\n\u003ch4\u003eGet Started (tl;dr version)\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not access, impact, destroy or otherwise negatively impact Atlassian customers, or customer data in anyway.\u003c/li\u003e\n\u003cli\u003eEnsure that you use your \u003cem\u003e@bugcrowdninja.com\u003c/em\u003e email address.\u003c/li\u003e\n\u003cli\u003eBounties are awarded differently per product (see below for more details on payouts).\u003c/li\u003e\n\u003cli\u003eEnsure you understand the targets, scopes, exclusions, and rules in Scope \u0026amp; Rewards.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFocus Areas\u003c/h3\u003e\n\n\u003cp\u003eDue to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we're more interested in traditional web application vulnerabilities, as well as other vulnerabilities that can have a direct impact to our products. Below is a list of some of the vulnerability classes that we are seeking reports for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCross Instance Data Leakage/Access**\u003c/li\u003e\n\u003cli\u003eServer-side Remote Code Execution (RCE)\u003c/li\u003e\n\u003cli\u003eServer-Side Request Forgery (SSRF)\u003c/li\u003e\n\u003cli\u003eStored/Reflected Cross-site Scripting (XSS)\u003c/li\u003e\n\u003cli\u003eCross-site Request Forgery (CSRF)\u003c/li\u003e\n\u003cli\u003eSQL Injection (SQLi)\u003c/li\u003e\n\u003cli\u003eXML External Entity Attacks (XXE)\u003c/li\u003e\n\u003cli\u003eAccess Control Vulnerabilities (Insecure Direct Object Reference issues, etc)\u003c/li\u003e\n\u003cli\u003ePath/Directory Traversal Issues\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eEnsure you review the out of scope and exclusions list for further details.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. \u003c/p\u003e\n\n\u003ch4\u003eProduct Quick Links\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003ca href=\"https://www.atlassian.com/ondemand/signup/form?product=confluence.ondemand,jira-software.ondemand,jira-servicedesk.ondemand\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJira and Confluence Cloud:\u003c/a\u003e \n\n\u003cul\u003e\n\u003cli\u003eUse the following naming convention for your cloud instance: bugbounty-test-\u0026lt;bugcrowd-name\u0026gt;.atlassian.net\u003c/li\u003e\n\u003cli\u003eOnce your cloud instance is set up, you can add additional cloud products at \u003ca href=\"https://admin.atlassian.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAtlassian Administration\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/bitbucket/bundle\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitbucket Cloud\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eData Center Products\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/jira/download/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJira Software Data Center\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/confluence/download/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eConfluence Data Center\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/bitbucket/download/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitbucket Data Center\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/crowd/download/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCrowd Data Center\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/bamboo/download\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBamboo Data Center\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eOther Products\u003cbr\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/crucible/download\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCrucible\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/fisheye/download\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFisheye\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/sourcetree\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSourcetree\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWe only accept vulnerabilities affecting the latest version of the product you are testing\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMobile Products:\n\n\u003cul\u003e\n\u003cli\u003eJira Cloud (\u003ca href=\"https://itunes.apple.com/us/app/jira-cloud/id1006972087?mt=8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eiOS\u003c/a\u003e, \u003ca href=\"https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core\u0026amp;hl=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eConfluence Cloud (\u003ca href=\"https://itunes.apple.com/us/app/confluence-cloud/id1006971684?mt=8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eiOS\u003c/a\u003e, \u003ca href=\"https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core\u0026amp;hl=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eJira Data Center (\u003ca href=\"https://apps.apple.com/us/app/jira-data-center-and-server/id1405353949\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eiOS\u003c/a\u003e, \u003ca href=\"https://play.google.com/store/apps/details?id=com.atlassian.jira.server\u0026amp;hl=en_US\u0026amp;gl=US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eConfluence Data Center (\u003ca href=\"https://apps.apple.com/us/app/confluence-data-center-server/id1288365159\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eiOS\u003c/a\u003e, \u003ca href=\"https://play.google.com/store/apps/details?id=com.atlassian.confluence.server\u0026amp;hl=en_US\u0026amp;gl=US\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAndroid\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eCreating Your Instance\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eJira + Confluence Cloud\u003c/strong\u003e\u003cbr\u003e\nTo access the instance and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the below steps:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNavigate to this page \u003ca href=\"https://www.atlassian.com/ondemand/signup/form?product=confluence.ondemand,jira-software.ondemand,jira-servicedesk.ondemand\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eComplete the verification flow\u003c/li\u003e\n\u003cli\u003eWhen it is time to rename your instance, using the following format: \u003cstrong\u003ebugbounty-test-\u0026lt;bugcrowd-name\u0026gt;\u003c/strong\u003e\nNote that \u0026lt;bugcrowd-name\u0026gt; should be replaced with your own bugcrowd username \u003c/li\u003e\n\u003cli\u003eClick \"Agree\"\u003c/li\u003e\n\u003cli\u003eOnce your instance has been completed that's it - you can test away!\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eAdditional Cloud Products\u003c/strong\u003e\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eOnce your cloud instance is set up, you can add additional products via \u003ca href=\"https://admin.atlassian.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAtlassian Administration\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eGo to the \"Products\" tab\u003c/li\u003e\n\u003cli\u003eClick on \"Add product\"\u003c/li\u003e\n\u003cli\u003eSelect the cloud products you would like to add (e.g Jira Product Discovery, Jira Service Management, Jira Work Management, Statuspage)\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003e\u003cstrong\u003eBitbucket Cloud\u003c/strong\u003e\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eNavigate to https://bitbucket.org/ and select \"Log In\"\u003c/li\u003e\n\u003cli\u003eSelect \"Sign Up\" and create an account with your \u003cstrong\u003e@bugcrowdninja.com\u003c/strong\u003e email address.\u003c/li\u003e\n\u003cli\u003eStart testing!\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003e\u003cstrong\u003eAll Atlassian Data Center Products\u003c/strong\u003e\u003cbr\u003e\nTo access the target and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the steps below:\u003cbr\u003e\n1 - Go to \u003ca href=\"https://www.atlassian.com/company/contact/purchasing-licensing#/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ePurchasing Licensing\u003c/a\u003e\u003cbr\u003e\n2 - In the How can we help you dropdown, select Product trials.\u003cbr\u003e\n3 - In the Choose a topic dropdown, select Trial a new product.\u003cbr\u003e\n4 - At the bottom, select Need more help.\u003cbr\u003e\n5 - In the Your Question field, type in your request.\u003cbr\u003e\n6 - Submit your request and our support will help you get set up.\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003eNavigate to Data Center product link above\u003c/li\u003e\n\u003cli\u003eDownload the latest version of the product you want to test\u003c/li\u003e\n\u003cli\u003eInstall the product, with the trial license from the process above.\u003c/li\u003e\n\u003cli\u003eStart testing\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eTo spin up a local Docker instance follow the steps located at:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/confluence-server\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eConfluence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/jira-core\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJira Core\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/jira-software\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJira Software\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/jira-servicemanagement\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eJira Service Management\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/bitbucket-server\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitbucket\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/crowd\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCrowd\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/fisheye\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFisheye\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://hub.docker.com/r/atlassian/bamboo\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBamboo\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: After the trial period expires you can generate another evaluation license and continue researching. Please remember to check that you are still on the latest version.\u003c/p\u003e\n\n\u003ch2\u003eDisclosure Request Guidance\u003c/h2\u003e\n\n\u003cp\u003eSubmissions that meet the following requirements will be considered for disclosure upon request:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe submission has been accepted\u003c/li\u003e\n\u003cli\u003eThe reported vulnerability has been fixed and released in production\u003c/li\u003e\n\u003cli\u003eThe submission does not regard a customer instance or a customer’s account \u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003ch3\u003eRules, Exclusions, and Scopes\u003c/h3\u003e\n\n\u003cp\u003eAny domain/property of Atlassian not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). \u003cstrong\u003eFor cloud instances, researchers should use the \"bugbounty-test-\u0026lt;bugcrowd-name\u0026gt;.atlassian.net\" namespace\u003c/strong\u003e provided in the instructions below. Please do not create additional instances outside of this namespace for testing.\u003c/p\u003e\n\n\u003cp\u003eAll resources within your instance is in scope (see below for exclusions), this includes the all of the REST APIs and any *.atlassian.com or *.atl-paas.net service that can be exploited from an in scope product.\u003c/p\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eAnything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However to help avoid grey areas, below are examples of what is considered out of scope.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIdentifying apps which are installed, as long as the user level has access to the instance, is known as part of the Atlassian Connect threat model, and is an accepted risk. Please do not report this.\u003c/li\u003e\n\u003cli\u003eEnumeration or information disclosure of non-sensitive information (e.g. issue keys, project keys, commit hashes).\u003c/li\u003e\n\u003cli\u003eBlind XSS must not return any user data that you do not have access to (e.g. Screen shots, cookies that aren't owned by you, etc); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your webserver, etc).\u003c/li\u003e\n\u003cli\u003eXSSs on Data Center instances that require administrator privileges will be scored as \u003ccode\u003eP5 Informational\u003c/code\u003e and awarded points only, as they don't let the attacker compromise Confidentiality, Integrity or Availability any more than they already could as an administrator.\u003c/li\u003e\n\u003cli\u003eWhen testing, please exercise caution if injecting on any form that may be publicly visible - such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with support@bugcrowd before performing the testing. \u003c/li\u003e\n\u003cli\u003eNo pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues.\u003c/li\u003e\n\u003cli\u003eCustomer cloud and data center/server instances and customer data are explicitly out of scope. Customer cloud instances may be in the form of *.atlassian.net or *.jira.com. Please only test your own \"bugbounty-test-\u0026lt;bugcrowd-name\u0026gt;.atlassian.net\" cloud instance or locally instantiated data center/server instance. \u003c/li\u003e\n\u003cli\u003eAny repository that you are not an owner of - do not impact Atlassian customers in any way.\u003c/li\u003e\n\u003cli\u003eAny Atlassian billing system. However, specific endpoints that are used inside of a target are in scope. For example, if a REST endpoint is proven to be called from one of the targets, then that endpoint is considered to be in scope. However, all other endpoints are not considered to be in scope, as they are not called from the instance at any stage.\u003c/li\u003e\n\u003cli\u003eOnly the latest version of a Data Center product is eligible for a reward. All vulnerabilities/exploits must be proven to work in the latest version of the Atlassian Data Center product.\u003c/li\u003e\n\u003cli\u003eAny internal, development, staging, or testing services with no clear security impact to any production data or infrastructure.\u003c/li\u003e\n\u003cli\u003eThird party add-ons/integrations others than those listed in the targets from the marketplace are strictly excluded (vulnerabilities that exist within third-party apps in any way) - we will pass on any vulnerabilities found, however, they will not be eligible for a bounty.\u003c/li\u003e\n\u003cli\u003eVulnerabilities that have been fixed by the vendor within the last 7 days (i.e. we will not accept reports that we are vulnerable to CVE-XXXX-XXXX within 7 days of the patch by the vendor to give our internal teams a chance to detect and patch the issue)\u003c/li\u003e\n\u003cli\u003eDenial of Service (DoS) reports on cloud products are specifically out of scope. \u003cstrong\u003eDo not perform DoS attacks on any cloud instance.\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eDoS reports on Data Center products related to lack of rate limiting, request flooding, resource exhaustion, or other similar network layer/volume based attacks are not accepted.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThe following finding types are specifically excluded from the bounty (no payout)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe use of automated scanners is strictly prohibited (we have these tools too - don't even think about using them)\u003c/li\u003e\n\u003cli\u003eDescriptive error messages (e.g. stack traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eFingerprinting / banner disclosure on common/public services.\u003c/li\u003e\n\u003cli\u003eClickjacking and issues only exploitable through clickjacking.\u003c/li\u003e\n\u003cli\u003eLogout Cross-Site Request Forgery (logout CSRF).\u003c/li\u003e\n\u003cli\u003eContent Spoofing.\u003c/li\u003e\n\u003cli\u003ePresence of application or web browser ‘autocomplete’ or ‘save password’ functionality.\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies.\u003c/li\u003e\n\u003cli\u003eLack of \"security speed bump\" when leaving the site.\u003c/li\u003e\n\u003cli\u003eWeak Captcha / Captcha bypass.\u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force and account lockout not enforced.\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration.\u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers, specifically (\u003ca href=\"https://owasp.org/www-project-secure-headers/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://owasp.org/www-project-secure-headers/\u003c/a\u003e), e.g.\n\n\u003cul\u003e\n\u003cli\u003eStrict-Transport-Security.\u003c/li\u003e\n\u003cli\u003eX-Frame-Options.\u003c/li\u003e\n\u003cli\u003eX-XSS-Protection.\u003c/li\u003e\n\u003cli\u003eX-Content-Type-Options.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy-Report-Only.\u003c/li\u003e\n\u003cli\u003eCache-Control and Pragma\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eHTTP/DNS cache poisoning.\u003c/li\u003e\n\u003cli\u003eSSL/TLS Issues, e.g.\n\n\u003cul\u003e\n\u003cli\u003eSSL Attacks such as BEAST, BREACH, Renegotiation attack.\u003c/li\u003e\n\u003cli\u003eSSL Forward secrecy not enabled.\u003c/li\u003e\n\u003cli\u003eSSL weak/insecure cipher suites.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSelf-XSS reports will not be accepted.\n\n\u003cul\u003e\n\u003cli\u003eSimilarly, any XSS where local access is required (i.e. User-Agent Header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will allow for the XSS to trigger.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eVulnerabilities that are limited to unsupported browsers will not be accepted (i.e. \"this exploit only works in IE6/IE7\"). A list of supported browsers can be found \u003ca href=\"https://confluence.atlassian.com/display/Cloud/Supported+browsers\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eKnown vulnerabilities in used libraries, or the reports that an Atlassian product uses an outdated third party library (e.g. jQuery, Apache HttpComponents etc) unless you can prove exploitability.\u003c/li\u003e\n\u003cli\u003eMissing or incorrect SPF records of any kind.\u003c/li\u003e\n\u003cli\u003eMissing or incorrect DMARC records of any kind.\u003c/li\u003e\n\u003cli\u003eSource code disclosure vulnerabilities.\u003c/li\u003e\n\u003cli\u003eInformation disclosure of non-confidential information (e. g. issue id, project id, commit hashes).\u003c/li\u003e\n\u003cli\u003eThe ability to upload/download viruses or malicious files to the platform.\u003c/li\u003e\n\u003cli\u003eEmail bombing\u003c/li\u003e\n\u003cli\u003eRequest Flooding\u003c/li\u003e\n\u003cli\u003eLack of rate limiting\u003c/li\u003e\n\u003cli\u003eCSV Injection\u003c/li\u003e\n\u003cli\u003eIssues where paid or premium features are accessible on free accounts with no inherent \"security\" implications (impacts to the Confidentiality, Integrity, Availability of the product) may be considered Informational and rewarded points.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou must ensure that customer data is not affected in any way as a result of your testing. Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under “Creating your instance” above.\u003c/li\u003e\n\u003cli\u003eIn addition to above, customer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or \"verified\")\n\n\u003cul\u003e\n\u003cli\u003eIf you believe you have found sensitive customer data (e.g., login credentials, API keys etc) or a way to access customer data (i.e. through a vulnerability) report it, but \u003cstrong\u003edo not attempt to validate or authenticate with these credentials.\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eIf you come across Atlassian Employee login credentials, API keys, or similar sensitive information, please report it immediately. \u003cstrong\u003eHowever, please do not attempt to verify or authenticate with these credentials.\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cem\u003eUse of any automated tools/scanners is strictly prohibited\u003c/em\u003e and will lead to you being removed from the program (trust us, we have those tools too).\u003c/li\u003e\n\u003cli\u003eReports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text.\u003c/li\u003e\n\u003cli\u003eTo facilitate timely report acceptance, please utilize the \u003cstrong\u003eReporting Guidelines\u003c/strong\u003e below.\u003c/li\u003e\n\u003cli\u003eSufficiently similar access control issues should be grouped in one report. Atlassian defines “sufficiently similar” as issues that use the same permissions/configuration for bypassing a particular control, which may be used on multiple related vulnerable endpoints or actions (User X with Y permissions can Create/Delete/Edit Resource Z).\u003c/li\u003e\n\u003cli\u003eGrants/awards are at the discretion of Atlassian and we withhold the right to grant, modify or deny grants. But we'll be fair about it.\u003c/li\u003e\n\u003cli\u003eTax implications of any payouts are the sole responsibility of the reporter.\u003c/li\u003e\n\u003cli\u003eDo NOT conduct non-technical attacks such as social engineering or phishing attacks on Atlassian, its staff, or customers. Reports that rely on theoretical social engineering or phishing for a successful attack may be considered albeit with a much lesser severity impact.\u003c/li\u003e\n\u003cli\u003eDo NOT test the physical security of Atlassian offices, employees, equipment, etc.\u003c/li\u003e\n\u003cli\u003eThis bounty follows Bugcrowd’s standard disclosure terms.\u003c/li\u003e\n\u003cli\u003eAny vulnerability found in a JIRA or Confluence Data Center product may not be eligible for a reward in Jira/Confluence Cloud, and vice versa (i.e. no double dipping).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eScoring and Exceptions\u003c/h3\u003e\n\n\u003cp\u003eAtlassian uses \u003ca href=\"https://www.atlassian.com/trust/security/security-severity-levels\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCVSS\u003c/a\u003e to consistently score security vulnerabilities. There may be internal mitigations or controls that affect the final CVSS score and thus final assessed severity. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority. \u003cbr\u003e\nA few issue types are not scored by their CVSS scores. These are typically higher severity, but will be rewarded as P4 issues:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eXSS Vulnerabilities where the script is blocked by the product's Content Security Policy, unless a bypass is documented as part of the submission\u003c/li\u003e\n\u003cli\u003eXSS Vulnerabilities where the session cookie has HTTPOnly and Secure Flag set, unless extraction of the session cookie is documented as part of the submission\u003c/li\u003e\n\u003cli\u003eOpen Redirect bugs, and\u003c/li\u003e\n\u003cli\u003eBroken Access Control or Privilege Escalation bugs, where an Administrator is able to perform System Administrator actions.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eThese are typically CVSS High (P2) but will be rewarded as Medium (P3) issues:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eXSS in Data Center products\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eReporting Credentials\u003c/h3\u003e\n\n\u003cp\u003eIf you believe you have found Atlassian employee or customer credentials please report them but do \u003cstrong\u003enot\u003c/strong\u003e attempt to validate them.\u003cbr\u003e\nCredential Reports will be handled as follows:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCustomer credential reports will be marked as P5 (Informational)\u003c/li\u003e\n\u003cli\u003eAtlassian employee credentials will have severity adjusted based on CVSS, but will only be paid out if they can access Atlassian resources (i.e. credentials not related to their work at Atlassian will receive points but will not be paid out)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eReporting Guidelines\u003c/h3\u003e\n\n\u003cp\u003eA well-crafted report enables effective communication of the issue to our product teams. It also simplifies the process of replicating and validating the submission. A submission that is clear and comprehensively documented aids in triage, validation, and leads to expedited report acceptance.\u003cbr\u003e\nWhere applicable, the following information should be included:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBrief summary of the submission (including product versions tested for Data Center products)\u003c/li\u003e\n\u003cli\u003ePrerequisites or initial conditions (including any products, user privileges, tools required, files prepared, web server configurations, or any other initial conditions which need to be set prior to initiating the proof of concept)\u003c/li\u003e\n\u003cli\u003eReproduction steps (including any vulnerable endpoints, parameters, payloads used, source code for scripts, or command line inputs)\n\n\u003cul\u003e\n\u003cli\u003eInclusion of burp requests (or HTTP request examples), screenshots, and screen recordings are highly encouraged.\u003c/li\u003e\n\u003cli\u003eTemplates and/or scripts for testing, such as a nuclei template or python script, are desirable for a submission.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eExpected results / behaviour vs actual results / behaviour. Please include any links to formal documentation or resources which state the expected behaviour.\u003c/li\u003e\n\u003cli\u003eAssessed security impact (as it relates to the Confidentiality, Integrity, and/or Availability of the product)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWhere possible, the following information is could be additionally included:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePossible mitigations, fixes and security controls (The more product specific the better).\u003c/li\u003e\n\u003cli\u003eRoot cause analysis of the vulnerability.\u003c/li\u003e\n\u003cli\u003eBusiness impact.\u003c/li\u003e\n\u003cli\u003eFor Data Center and on-premise products, a list of impacted versions beyond current version.\u003c/li\u003e\n\u003cli\u003eReferences.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ePublic Disclosure\u003c/h3\u003e\n\n\u003cp\u003eAt Atlassian, one of our values is Open Company, No Bullshit, we believe that vulnerability disclosure is a part of that value. We hold ourselves to the security bug fix service level objectives, found \u003ca href=\"https://www.atlassian.com/trust/security/bug-fix-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e, and will accept disclosure requests in the bug bounty program after the issue has been fixed and released in production. However, if the report contains any information regarding a customer instance or data the request will be rejected. If you are planning to disclose outside of the bug bounty, we ask that you give us reasonable notice and wait until the \u003ca href=\"https://www.atlassian.com/trust/security/bug-fix-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eassociated SLO\u003c/a\u003e has passed.  \u003c/p\u003e\n\n\u003ch3\u003eSafe Harbor\u003c/h3\u003e\n\n\u003cp\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003cbr\u003e\nIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"0429ce8d-1fd9-45a5-8856-24a68fc146a3","name":"Tier 1 ","targets":[{"id":"abb6a8f5-2778-417f-bd42-29955d1a5b9b","uri":"https://admin.atlassian.com/atlassian-guard","name":"Atlassian Guard Standard and Premium (https://admin.atlassian.com/atlassian-guard)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c3c6ae62-585c-446c-9437-50965a6160cd","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"abb6a8f5-2778-417f-bd42-29955d1a5b9b"}],"recentChangeFlags":null},{"id":"3245258e-4b2c-41b7-af09-6a17e0ef2cb4","uri":"https://admin.atlassian.com/","name":"Atlassian Admin (https://admin.atlassian.com/)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"64fdbdc3-7191-4be5-8c7a-a199c31f1c33","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3245258e-4b2c-41b7-af09-6a17e0ef2cb4"}],"recentChangeFlags":null},{"id":"c717373c-4262-4b6d-a741-46d24120ccd0","uri":"https://id.atlassian.com/login","name":"Atlassian Identity (https://id.atlassian.com/login)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4f34a8ea-da98-44de-82c4-efea0ebdb4b9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c717373c-4262-4b6d-a741-46d24120ccd0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c717373c-4262-4b6d-a741-46d24120ccd0"}],"recentChangeFlags":null},{"id":"38af1824-d3a5-4482-9d70-a9309aa36cde","uri":"https://start.atlassian.com","name":"Atlassian Start (https://start.atlassian.com)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2491aaa9-fbde-44e7-ae01-9bcdce2a9005","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"38af1824-d3a5-4482-9d70-a9309aa36cde"}],"recentChangeFlags":null},{"id":"82b75d85-99a5-4ae6-af40-663be8fc1280","uri":"https://bitbucket.org","name":"Bitbucket Cloud including Bitbucket Pipelines (https://bitbucket.org)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"178c5f17-3759-402f-a35a-94774700fae4","sortOrder":0},"sortOrder":0,"tags":[{"id":"84ff9b26-d234-4bba-8b77-f0f02d67d359","name":"Django","targetId":"82b75d85-99a5-4ae6-af40-663be8fc1280"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"82b75d85-99a5-4ae6-af40-663be8fc1280"}],"recentChangeFlags":null},{"id":"fb3640d3-19be-4996-8e83-d82ffd3e014e","uri":"https://www.atlassian.com/software/confluence","name":"Confluence Cloud (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net/wiki)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bc2d271f-1b3b-4d56-93b6-372e634d4bae","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fb3640d3-19be-4996-8e83-d82ffd3e014e"}],"recentChangeFlags":null},{"id":"79b983e7-1c3b-495c-b8bb-646f2242e639","uri":"https://www.atlassian.com/software/confluence/premium","name":"Confluence Cloud Premium (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net/wiki)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2e912249-0c5b-422f-bec8-827865484cb6","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"79b983e7-1c3b-495c-b8bb-646f2242e639"}],"recentChangeFlags":null},{"id":"bc6d51d0-6313-4e2f-83fe-75a5f29499fa","uri":"https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core\u0026hl=en_US\u0026gl=US","name":"Confluence Cloud Mobile App for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1b607ca3-593c-4a67-951b-b2529fca5e5b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"bc6d51d0-6313-4e2f-83fe-75a5f29499fa"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"bc6d51d0-6313-4e2f-83fe-75a5f29499fa"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"bc6d51d0-6313-4e2f-83fe-75a5f29499fa"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"bc6d51d0-6313-4e2f-83fe-75a5f29499fa"}],"recentChangeFlags":null},{"id":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7","uri":"https://apps.apple.com/us/app/confluence-cloud/id1006971684","name":"Confluence Cloud Mobile App for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8a5cdf26-af46-4941-9529-473c9b4924a2","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"a7e3a1b9-d4f7-4cd1-b01b-0f7f2a3f10e7"}],"recentChangeFlags":null},{"id":"0756fb47-0a6b-48b3-8597-692009a8782e","uri":"https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core\u0026hl=en_US\u0026gl=US","name":"Jira Cloud Mobile App for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c8840a45-98ae-4314-90fc-fb8c9976bdc0","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0756fb47-0a6b-48b3-8597-692009a8782e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"0756fb47-0a6b-48b3-8597-692009a8782e"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"0756fb47-0a6b-48b3-8597-692009a8782e"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"0756fb47-0a6b-48b3-8597-692009a8782e"}],"recentChangeFlags":null},{"id":"087e970c-c386-4b5a-9a26-333429bc94b9","uri":"https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087","name":"Jira Cloud Mobile App for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"df7f42ad-1e08-4c78-8b08-6830392971aa","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"087e970c-c386-4b5a-9a26-333429bc94b9"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"087e970c-c386-4b5a-9a26-333429bc94b9"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"087e970c-c386-4b5a-9a26-333429bc94b9"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"087e970c-c386-4b5a-9a26-333429bc94b9"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"087e970c-c386-4b5a-9a26-333429bc94b9"}],"recentChangeFlags":null},{"id":"64b63c50-7fa2-4053-a45c-005ed992af16","uri":"https://www.atlassian.com/software/jira/service-management","name":"Jira Service Management Cloud (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"329f4ad1-db68-493e-9d5a-60bd3a85d0e6","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"64b63c50-7fa2-4053-a45c-005ed992af16"}],"recentChangeFlags":null},{"id":"522ae601-ccda-4e96-b923-291da45f7028","uri":"https://www.atlassian.com/software/jira","name":"Jira Software Cloud (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9533f10c-1de8-4cfb-b056-7607b3698758","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"522ae601-ccda-4e96-b923-291da45f7028"}],"recentChangeFlags":null},{"id":"8de3a3de-b77f-4ac8-8694-3e35e5a19298","uri":"https://www.atlassian.com/software/jira/work-management","name":"Jira Work Management Cloud formerly Jira Core (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"18a99024-2610-4607-a08e-554f7d4a2334","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"8de3a3de-b77f-4ac8-8694-3e35e5a19298"},{"id":"6155adbb-bc15-4203-8b79-bd7a589ae5b4","name":"Redux","targetId":"8de3a3de-b77f-4ac8-8694-3e35e5a19298"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"8de3a3de-b77f-4ac8-8694-3e35e5a19298"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8de3a3de-b77f-4ac8-8694-3e35e5a19298"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"8de3a3de-b77f-4ac8-8694-3e35e5a19298"}],"recentChangeFlags":null},{"id":"e517fba4-2e04-49a1-bcae-5999b44cff2c","uri":null,"name":"Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4ccc48b2-16ad-4b96-ae43-05dea901e7f2","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"90b6e548-67cc-4d9f-8f7f-e5dea0dd14ca","p1MaxCents":1200000,"p1MinCents":1200000,"p2MaxCents":400000,"p2MinCents":400000,"p3MaxCents":32500,"p3MinCents":32500,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":12000,"max":12000},"2":{"min":4000,"max":4000},"3":{"min":325,"max":325},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"1ca5aecc-1718-4003-865d-e99f17e8ecbc","name":"Rovo, Rovo Dev and other AI Features","targets":[{"id":"9ebe54e7-c94a-40c9-b658-3ffff70713e2","uri":"https://www.atlassian.com/software/rovo","name":"Rovo","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ae96eca3-b8a6-4685-ac63-b6955b51f4ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9ebe54e7-c94a-40c9-b658-3ffff70713e2"}],"recentChangeFlags":null},{"id":"bcd63897-23ac-4586-908b-0e9e9a4fdf76","uri":"https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/","name":"Rovo Dev CLI","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"402730de-2853-4699-9172-874ed07635a7","sortOrder":1},"sortOrder":1,"tags":[{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"bcd63897-23ac-4586-908b-0e9e9a4fdf76"}],"recentChangeFlags":null},{"id":"cc8cebed-a3cb-4261-a602-a0218d3196c6","uri":"https://www.atlassian.com/software/rovo-dev","name":"Other Rovo Dev","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cb4ecf27-7dfa-49d4-b401-f73b30f2e84b","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cc8cebed-a3cb-4261-a602-a0218d3196c6"}],"recentChangeFlags":null},{"id":"9edcb8c0-5a85-4678-a01f-26fa5de15cbc","uri":"https://mcp.atlassian.com","name":"Atlassian MCP Server","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"175a81a7-e717-415a-85bd-ab8c6b9067c0","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"cee8b620-9db4-4706-be5e-447ccafe4b01","p1MaxCents":1200000,"p1MinCents":1200000,"p2MaxCents":600000,"p2MinCents":600000,"p3MaxCents":32500,"p3MinCents":32500,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch3\u003eIntroducing Rovo!\u003c/h3\u003e\n\n\u003cp\u003eRovo is Atlassian\u0026#39;s AI solution integrated into the Atlassian platform to help enable teams make better decisions and reach goals faster. Rovo, in addition to other Atlassian Intelligence features are now formally part of the Atlassian Bug Bounty program! Please review the documentation \u003ca href=\"https://support.atlassian.com/rovo/resources/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e \u003c/p\u003e\n\n\u003ch3\u003eRovo Features in Scope:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/chat/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Chat\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/search/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Search\u003c/a\u003e including \u003ca href=\"https://support.atlassian.com/rovo/docs/manage-rovo-connectors/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Connectors\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/studio/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Studio\u003c/a\u003e including \u003ca href=\"https://support.atlassian.com/rovo/docs/create-and-edit-agents/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Agents\u003c/a\u003e and \u003ca href=\"https://developer.atlassian.com/platform/forge/manifest-reference/modules/rovo-agent/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Forge Agents\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://chromewebstore.google.com/detail/rovo/npbjhobkibekbklkghlhfhieggcggpdb?authuser=0\u0026hl=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Browser Extension\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/using-the-atlassian-rovo-slack-app/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Slack App\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/organization-administration/docs/understand-atlassian-intelligence-features-in-products/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOther AI Features in Atlassian Products\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/atlassian/atlassian-mcp-server\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAtlassian MCP Server\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003e\u003ca href=\"https://www.atlassian.com/software/rovo-dev\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Dev\u003c/a\u003e Products in Scope:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.atlassian.com/software/rovo-dev/code-review\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Dev Code Reviews\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eRovo Dev CLI\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.visualstudio.com/items?itemName=Atlassian.atlascode\u0026ssr=false#overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAtlassian Extension for VSCode\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://support.atlassian.com/rovo/docs/work-with-rovo-dev-agents/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOther Rovo Dev Features in Atlassian Products\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eAccepted Vulnerabilities\u003c/h3\u003e\n\n\u003cp\u003eIn addition to traditional web application vulnerabilities, we are also interested in:\u003c/p\u003e\n\n\u003ch4\u003eSearch and 3P data ingestion\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eBroken connector authentication, leakage of client secrets or tokens during the authorization process, insufficient validation of refresh tokens or token expiration.\u003c/li\u003e\n\u003cli\u003eData poisoning via injection of malicious, corrupted or malformed data into the ingested 3P content that leads to system crashes or behavior anomalies or compromise the integrity of the search index.\u003c/li\u003e\n\u003cli\u003eMismanagement of CORS policies leading to unauthorized cross-origin data fetching.\u003c/li\u003e\n\u003cli\u003eScope overreach while ingesting or persistence of access after 3P connector is deactivated or disconnected.\u003c/li\u003e\n\u003cli\u003eIf rate limits announced - exploitation of improperly enforced rate limits and quota on data ingestion, overloading connectors by exploiting insufficient throttling or queue management\u003c/li\u003e\n\u003cli\u003eImproper error handling that leaks sensitive information\u003c/li\u003e\n\u003cli\u003eAbusing legitimate connector functionalities to exfiltrate or manipulate data.\u003c/li\u003e\n\u003cli\u003eImproper enforcement of source-of-truth permissions after the data was ingested:\n\n\u003cul\u003e\n\u003cli\u003eseeing document titles, snippets, or summaries of restricted documents\u003c/li\u003e\n\u003cli\u003eany kinds of authorization failures, examples: permissions being out-of-sync, permissions drifts between source-of-truth systems and Atlassian\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eAI Agents and Chat\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eIncorrect information disclosure across projects, products, or workspaces due to improper filtering or misconfigured access controls.\u003c/li\u003e\n\u003cli\u003eCross product AI features inadvertently suggest or display restricted content bypassing access controls.\u003c/li\u003e\n\u003cli\u003eCross product AI features leak restricted content to LLM(s), sensitive data inadvertently displayed in AI-generated summaries or other features.\u003c/li\u003e\n\u003cli\u003eBypass or improper authorization policies enforcement in Agents and Rovo chat, including partial data exposure.\u003c/li\u003e\n\u003cli\u003eExploiting Forge integration security weaknesses\u003c/li\u003e\n\u003cli\u003eIf rate limits announced - exploitation of improperly enforced rate limits and quota\u003c/li\u003e\n\u003cli\u003eSensitive Information disclosure (PII) via AI features\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eOut of Scope or Non-eligible Issues\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eVulnerabilities related to GraphQL, cyclic hydration \u0026amp; large payload processing\u003c/li\u003e\n\u003cli\u003eThings not explicitly mentioned in \u003ca href=\"https://www.atlassian.com/legal/acceptable-use-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAcceptable Use Policy | Atlassian\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrivial jailbreak prompt injections, in terms of consequence\u003c/li\u003e\n\u003cli\u003eSupply Chain Vulnerabilities\u003c/li\u003e\n\u003cli\u003eVulnerabilities exposed through multi-turn attacks\u003c/li\u003e\n\u003cli\u003eAll kinds of insecure output handling and sensitive information disclosure not mentioned explicitly above\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eThe following will be awarded points only:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAbuse/Misuse/Ethical bypassing \u003ca href=\"https://www.atlassian.com/legal/acceptable-use-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAcceptable Use Policy | Atlassian\u003c/a\u003e (AUP) enforcement mechanism\n\n\u003cul\u003e\n\u003cli\u003eExploiting explicitly outlined categories in AUP\u003c/li\u003e\n\u003cli\u003eFlooding or overloading AUP enforcement mechanism \u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eGet Started\u003c/h3\u003e\n\n\u003cp\u003ePlease review the documentation \u003ca href=\"https://support.atlassian.com/organization-administration/docs/test-drive-rovo-with-your-organization/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e to get started with a trial of Rovo and test drive its features and functionalities.\u003c/p\u003e","rewardRangeData":{"1":{"min":12000,"max":12000},"2":{"min":6000,"max":6000},"3":{"min":325,"max":325},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"cfeeda86-b404-4633-897f-8b0e6fe2beb2","name":"Tier 2","targets":[{"id":"31e54ee1-869f-4aa2-b0e8-c9d8e94001e6","uri":"https://marketplace.atlassian.com","name":"Atlassian Marketplace (https://marketplace.atlassian.com)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"01dcdaff-baf6-4400-8e59-902bf3fe15d7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"31e54ee1-869f-4aa2-b0e8-c9d8e94001e6"}],"recentChangeFlags":null},{"id":"24a5079b-76dd-4817-a81c-3715e2e0e625","uri":"https://www.atlassian.com/software/atlas","name":"Atlassian Atlas","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"61876673-f3f1-472d-91ff-cc604ec76255","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"24a5079b-76dd-4817-a81c-3715e2e0e625"}],"recentChangeFlags":null},{"id":"cdf52371-4dd7-4e56-ba04-24b2bb61b43e","uri":"https://*.atlastunnel.com","name":"*.atlastunnel.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ca606eb5-b6b2-4cbd-805c-0409ef10c0b0","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cdf52371-4dd7-4e56-ba04-24b2bb61b43e"}],"recentChangeFlags":null},{"id":"f3e3dc1e-2833-4579-8742-c28290989e2a","uri":"","name":"Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b07c9f59-61e9-43f5-8b3d-877a2f861227","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f3e3dc1e-2833-4579-8742-c28290989e2a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"7f2abef1-7d71-48f2-aa86-9b61f27772b2","p1MaxCents":700000,"p1MinCents":700000,"p2MaxCents":250000,"p2MinCents":250000,"p3MaxCents":25000,"p3MinCents":25000,"p4MaxCents":17500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":7000,"max":7000},"2":{"min":2500,"max":2500},"3":{"min":250,"max":250},"4":{"min":175,"max":175},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"330261b8-505b-44f1-a0b4-97d65571c10f","name":"Atlassian Loom","targets":[{"id":"d83521ad-cc24-40b7-8443-bf219a13fb8a","uri":"https://www.loom.com/","name":"*.loom.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6be28a74-7bb3-4101-a499-cdddef135255","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d83521ad-cc24-40b7-8443-bf219a13fb8a"}],"recentChangeFlags":null},{"id":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11","uri":"https://www.loom.com/download","name":"Loom Desktop App (Windows)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bca7581b-ff76-4e91-98db-ec9368f42eb4","sortOrder":1},"sortOrder":1,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11"},{"id":"e18eb8da-333a-428b-aa65-4f9560491f2b","name":"Auth0","targetId":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"b1809259-eba0-46bc-a9ee-3fcbbcac6e11"}],"recentChangeFlags":null},{"id":"0d051a0b-3e5e-4a9c-a83a-655160e90273","uri":"https://www.loom.com/download","name":"Loom Desktop App (macOS)","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d7c6e607-4c99-4bd5-bedf-f16da351ffab","sortOrder":2},"sortOrder":2,"tags":[{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"},{"id":"47f8649b-7612-4d6d-bb41-c0078e628292","name":"Electron","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"},{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"},{"id":"c5df6ad0-33b4-40ac-b6dd-8d4038997d40","name":"macOS","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"},{"id":"e18eb8da-333a-428b-aa65-4f9560491f2b","name":"Auth0","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"0d051a0b-3e5e-4a9c-a83a-655160e90273"}],"recentChangeFlags":null},{"id":"1d7b3e7e-4e84-452b-b672-ce173921fc8d","uri":"https://play.google.com/store/apps/details?id=com.loom.android\u0026hl=en_US\u0026pli=1","name":"Loom for Android","category":"android","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f82632b2-dd1e-4ab1-86d6-7f067732a0f2","sortOrder":3},"sortOrder":3,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"1d7b3e7e-4e84-452b-b672-ce173921fc8d"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"1d7b3e7e-4e84-452b-b672-ce173921fc8d"}],"recentChangeFlags":null},{"id":"ffae639d-6c3e-420e-a0f8-28c3153e9cc8","uri":"https://apps.apple.com/us/app/loom-screen-recorder/id1474480829","name":"Loom for iOS","category":"ios","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1ae1a4a4-49ec-4721-87d2-3b5728e78cc4","sortOrder":4},"sortOrder":4,"tags":[{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"ffae639d-6c3e-420e-a0f8-28c3153e9cc8"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"ffae639d-6c3e-420e-a0f8-28c3153e9cc8"}],"recentChangeFlags":null},{"id":"aded28da-17a3-4069-a3ea-8d8850f28485","uri":"https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US\u0026pli=1","name":"Loom Chrome Extension","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"aff355d9-71b4-4363-a1d3-fb8b6d03ef1d","sortOrder":5},"sortOrder":5,"tags":[{"id":"59791207-9cf4-4498-b5e1-510fee95dc40","name":"Browser Extension","targetId":"aded28da-17a3-4069-a3ea-8d8850f28485"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"7f2abef1-7d71-48f2-aa86-9b61f27772b2","p1MaxCents":700000,"p1MinCents":700000,"p2MaxCents":250000,"p2MinCents":250000,"p3MaxCents":25000,"p3MinCents":25000,"p4MaxCents":17500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eYou can access our products from the quick links below:\u003c/p\u003e\n\n\u003ch4\u003eProduct Quick Links\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.loom.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom website\u003c/a\u003e - Sign up for free!\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.loom.com/download\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom Desktop App (macOS)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.loom.com/download\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom Desktop App (Windows)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US\u0026pli=1\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom Chrome Extension\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://play.google.com/store/apps/details?id=com.loom.android\u0026hl=en_US\u0026pli=1\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom for Android\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://apps.apple.com/us/app/loom-screen-recorder/id1474480829\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLoom for iOS\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":7000,"max":7000},"2":{"min":2500,"max":2500},"3":{"min":250,"max":250},"4":{"min":175,"max":175},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"3a63f9af-3756-4da0-9dc2-2452450477ba","name":"Tier 3","targets":[{"id":"c240071f-8977-42e2-b311-994bded7c7dd","uri":"https://www.atlassian.com/software/compass","name":"Atlassian Compass","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f2ef514a-6657-4620-8923-1a3302eb0786","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc","uri":"https://www.atlassian.com/software/bamboo","name":"Bamboo","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c52b6115-494a-459d-aa5d-548e0a8bccc8","sortOrder":1},"sortOrder":1,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"a14c606c-deb0-4d2b-a6a7-293c5d6f5dbc"}],"recentChangeFlags":null},{"id":"52e12d5a-f458-4b5a-b342-8d742f8fb6bf","uri":"https://www.atlassian.com/enterprise/data-center/bitbucket","name":"Bitbucket Data Center","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"04b59565-8c59-4912-8439-9d67b24e9b88","sortOrder":2},"sortOrder":2,"tags":[{"id":"84ff9b26-d234-4bba-8b77-f0f02d67d359","name":"Django","targetId":"52e12d5a-f458-4b5a-b342-8d742f8fb6bf"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"52e12d5a-f458-4b5a-b342-8d742f8fb6bf"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"52e12d5a-f458-4b5a-b342-8d742f8fb6bf"},{"id":"f21f7de7-31b4-4cc8-89a4-39c9eb6b7345","name":"Python","targetId":"52e12d5a-f458-4b5a-b342-8d742f8fb6bf"}],"recentChangeFlags":null},{"id":"099f7663-01c6-42f4-adc3-0c28dc5ddf01","uri":"https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html","name":"Confluence Companion App for macOS and Windows","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"66209bd1-78d7-4659-a3bf-0a475a2bd5cc","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"7056ae37-2dec-4738-b6a1-6a5babe0d4c5","uri":"https://play.google.com/store/apps/details?id=com.atlassian.confluence.server","name":"Confluence Data Center Mobile App for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"26d28618-8f60-4ab5-93f9-d416e6e5dae9","sortOrder":4},"sortOrder":4,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"7056ae37-2dec-4738-b6a1-6a5babe0d4c5"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"7056ae37-2dec-4738-b6a1-6a5babe0d4c5"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"7056ae37-2dec-4738-b6a1-6a5babe0d4c5"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"7056ae37-2dec-4738-b6a1-6a5babe0d4c5"}],"recentChangeFlags":null},{"id":"d70a0e20-f120-4625-a12d-6efc29038120","uri":"https://apps.apple.com/us/app/confluence-server/id1288365159","name":"Confluence Data Center Mobile App for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"76c017fe-a1f7-464b-a435-a184f5db507d","sortOrder":5},"sortOrder":5,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"d70a0e20-f120-4625-a12d-6efc29038120"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"d70a0e20-f120-4625-a12d-6efc29038120"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"d70a0e20-f120-4625-a12d-6efc29038120"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"d70a0e20-f120-4625-a12d-6efc29038120"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"d70a0e20-f120-4625-a12d-6efc29038120"}],"recentChangeFlags":null},{"id":"df015eda-2142-4f3a-8c96-5e1ae70df710","uri":"https://www.atlassian.com/software/crucible","name":"Crucible","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e855b32c-985a-42c2-a029-b4a51266a623","sortOrder":6},"sortOrder":6,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"df015eda-2142-4f3a-8c96-5e1ae70df710"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"df015eda-2142-4f3a-8c96-5e1ae70df710"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"df015eda-2142-4f3a-8c96-5e1ae70df710"}],"recentChangeFlags":null},{"id":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3","uri":"https://www.atlassian.com/enterprise/data-center/confluence","name":"Confluence Data Center","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"336d5b62-5f98-4f4d-8b1c-67986bee17a6","sortOrder":7},"sortOrder":7,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3"},{"id":"dd77bcb0-46ec-418e-bc51-4117f2aa872b","name":"TinyMCE","targetId":"cbac4bd4-673e-4ed0-97e7-bae2c26c71f3"}],"recentChangeFlags":null},{"id":"7ec3d900-03f6-4606-a997-16d35dc2647f","uri":"https://www.atlassian.com/enterprise/data-center/crowd","name":"Crowd","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5109ee90-4694-4337-8a30-16eb20e9ae85","sortOrder":8},"sortOrder":8,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"7ec3d900-03f6-4606-a997-16d35dc2647f"},{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7ec3d900-03f6-4606-a997-16d35dc2647f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7ec3d900-03f6-4606-a997-16d35dc2647f"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"7ec3d900-03f6-4606-a997-16d35dc2647f"}],"recentChangeFlags":null},{"id":"4b9cfd27-ea04-4904-8f2a-563ae11ed1bb","uri":"https://www.atlassian.com/software/fisheye","name":"FishEye","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fda62d99-7804-4941-aaa0-fdb4279e919e","sortOrder":9},"sortOrder":9,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"4b9cfd27-ea04-4904-8f2a-563ae11ed1bb"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4b9cfd27-ea04-4904-8f2a-563ae11ed1bb"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"4b9cfd27-ea04-4904-8f2a-563ae11ed1bb"}],"recentChangeFlags":null},{"id":"75f47a62-d8fd-4aed-a03f-594b2a2e9118","uri":"https://www.atlassian.com/enterprise/data-center/jira","name":"Jira Core Data Center","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fe5dc024-3534-40df-9f13-fd6621d039c4","sortOrder":10},"sortOrder":10,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"75f47a62-d8fd-4aed-a03f-594b2a2e9118"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"75f47a62-d8fd-4aed-a03f-594b2a2e9118"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"75f47a62-d8fd-4aed-a03f-594b2a2e9118"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"75f47a62-d8fd-4aed-a03f-594b2a2e9118"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"75f47a62-d8fd-4aed-a03f-594b2a2e9118"}],"recentChangeFlags":null},{"id":"642024b1-1f87-4720-949e-376f1fbd1ec3","uri":"https://play.google.com/store/apps/details?id=com.atlassian.jira.server\u0026hl=en_US\u0026gl=US","name":"Jira Data Center Mobile App for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cdf5e094-ce53-424f-94b3-bd79c2bbbd49","sortOrder":11},"sortOrder":11,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"642024b1-1f87-4720-949e-376f1fbd1ec3"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"642024b1-1f87-4720-949e-376f1fbd1ec3"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"642024b1-1f87-4720-949e-376f1fbd1ec3"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"642024b1-1f87-4720-949e-376f1fbd1ec3"}],"recentChangeFlags":null},{"id":"db511334-2597-4319-a2f7-dc61939bca20","uri":"https://apps.apple.com/us/app/jira-server/id1405353949","name":"Jira Data Center Mobile App for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ccdbacd9-9e14-4d84-88f8-46425febb67c","sortOrder":12},"sortOrder":12,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"db511334-2597-4319-a2f7-dc61939bca20"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"db511334-2597-4319-a2f7-dc61939bca20"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"db511334-2597-4319-a2f7-dc61939bca20"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"db511334-2597-4319-a2f7-dc61939bca20"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"db511334-2597-4319-a2f7-dc61939bca20"}],"recentChangeFlags":null},{"id":"054bde8d-f55e-4e27-bc10-ff4affbb90b2","uri":"https://www.atlassian.com/software/jira/product-discovery","name":"Jira Product Discovery","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"92cd790f-834f-4f28-a1a5-5c3643551856","sortOrder":13},"sortOrder":13,"tags":null,"recentChangeFlags":null},{"id":"e5754897-0cc6-439a-983a-eaf770fb94c4","uri":"https://www.atlassian.com/enterprise/data-center/jira/service-management","name":"Jira Service Management Data Center","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"85527b24-047d-4d9a-ac72-725a9421e0fb","sortOrder":14},"sortOrder":14,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"e5754897-0cc6-439a-983a-eaf770fb94c4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"e5754897-0cc6-439a-983a-eaf770fb94c4"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e5754897-0cc6-439a-983a-eaf770fb94c4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e5754897-0cc6-439a-983a-eaf770fb94c4"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"e5754897-0cc6-439a-983a-eaf770fb94c4"}],"recentChangeFlags":null},{"id":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b","uri":"https://www.atlassian.com/enterprise/data-center/jira","name":"Jira Software Data Center","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dd813516-8676-4754-aab5-3c42bc98a641","sortOrder":15},"sortOrder":15,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"0a5a90e7-4e59-4c9f-84d4-9c52329e107b"}],"recentChangeFlags":null},{"id":"4d2240bb-54d5-4d69-ac4b-8cecb556689f","uri":"https://www.sourcetreeapp.com/","name":"Sourcetree for macOS and Windows (https://www.sourcetreeapp.com/)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5a29ab3d-3199-4af2-9b95-455afc6514f5","sortOrder":16},"sortOrder":16,"tags":[{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"4d2240bb-54d5-4d69-ac4b-8cecb556689f"},{"id":"c5df6ad0-33b4-40ac-b6dd-8d4038997d40","name":"macOS","targetId":"4d2240bb-54d5-4d69-ac4b-8cecb556689f"},{"id":"fc8162a2-8e37-4a27-8cbd-3b40e7799f4e","name":"Desktop Application Testing","targetId":"4d2240bb-54d5-4d69-ac4b-8cecb556689f"}],"recentChangeFlags":null},{"id":"bc780d70-bd9a-44df-8056-5482379c8d8b","uri":null,"name":"Other - (all other Atlassian targets)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dd0aa72c-df9c-47cf-aa08-ba306b8c3b76","sortOrder":17},"sortOrder":17,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":{"id":"25b12c97-a7cb-46b1-833c-687d865f7798","p1MaxCents":400000,"p1MinCents":400000,"p2MaxCents":150000,"p2MinCents":150000,"p3MaxCents":17500,"p3MinCents":17500,"p4MaxCents":10000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":4000,"max":4000},"2":{"min":1500,"max":1500},"3":{"min":175,"max":175},"4":{"min":100,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"1f42cc06-04b0-401f-a239-952b517dc352","name":"Atlassian Forge","targets":[{"id":"a2481034-1f13-4c86-b627-8a14519990a5","uri":"","name":"Forge Platform","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4ff739a9-5a45-4dae-9127-85590b1f4228","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a2481034-1f13-4c86-b627-8a14519990a5"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"a2481034-1f13-4c86-b627-8a14519990a5"}],"recentChangeFlags":null},{"id":"9a31f767-2fee-4dad-8d5e-ca0f152b0287","uri":"","name":"GraphQL API (bugbounty-test-\u003cbugcrowd-name\u003e.atlassian.net/gateway/api/graphql)","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a8208aa0-24fd-4ac1-8c66-f1d93ec028d0","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"9a31f767-2fee-4dad-8d5e-ca0f152b0287"},{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"9a31f767-2fee-4dad-8d5e-ca0f152b0287"}],"recentChangeFlags":null},{"id":"98083f00-293f-421c-8372-6ee45442e69f","uri":"https://www.npmjs.com/package/@forge/cli\t","name":"https://www.npmjs.com/package/@forge/cli","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"19f374db-951b-4df5-a067-59d1f68d5d64","sortOrder":0},"sortOrder":0,"tags":[{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"98083f00-293f-421c-8372-6ee45442e69f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"98083f00-293f-421c-8372-6ee45442e69f"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"98083f00-293f-421c-8372-6ee45442e69f"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":5,"description":null,"rewardRange":{"id":"7f2abef1-7d71-48f2-aa86-9b61f27772b2","p1MaxCents":700000,"p1MinCents":700000,"p2MaxCents":250000,"p2MinCents":250000,"p3MaxCents":25000,"p3MinCents":25000,"p4MaxCents":17500,"p4MinCents":17500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eAtlassian Forge is an app development platform designed to revolutionize how Atlassian cloud products are customized, extended, and integrated.\u003c/p\u003e\n\n\u003cp\u003eMore information on the platform can be found here: \u003ca href=\"https://developer.atlassian.com/platform/forge/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developer.atlassian.com/platform/forge/\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eDue to the collaborative nature of Atlassian products, we are not interested in vulnerabilities surrounding enumeration and information gathering (being able to work effectively as a team is the purpose of our products). Instead, we\u0026#39;re more interested in vulnerabilities that can have a direct impact to the Forge Platform. Below is a list of some of the vulnerability classes that we are seeking reports for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eForge Platform\u003c/li\u003e\n\u003cli\u003eExecution environment\u003c/li\u003e\n\u003cli\u003eSandbox escapes\u003c/li\u003e\n\u003cli\u003eSupporting GraphQL endpoints\u003c/li\u003e\n\u003cli\u003eAccess Control Vulnerabilities (Insecure Direct Object Reference issues, etc)\u003c/li\u003e\n\u003cli\u003eServer-Side Request Forgery (SSRF)\u003c/li\u003e\n\u003cli\u003eForge CLI - https://www.npmjs.com/package/@forge/cli\u003c/li\u003e\n\u003cli\u003eDeployments\u003c/li\u003e\n\u003cli\u003eForge App Installation/Uninstallation flows\u003c/li\u003e\n\u003cli\u003eUI Kit\nStored/Reflected Cross-site Scripting (XSS) specifically targeting default behaviors of UI Kit elements\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":7000,"max":7000},"2":{"min":2500,"max":2500},"3":{"min":250,"max":250},"4":{"min":175,"max":175},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"4e345369-4aa7-4797-9691-4c9d6126274f","name":"Out of Scope","targets":[{"id":"203b530e-ca48-4a9e-8ab2-7e863976538a","uri":null,"name":"Any internal or development services.","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2826aaf5-b3e3-4568-aa99-5ae18ff9cd44","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"203b530e-ca48-4a9e-8ab2-7e863976538a"}],"recentChangeFlags":null},{"id":"9104797b-3603-44c7-9200-f852bb3f12b9","uri":"https://bugcrowd.com/atlassianapps","name":"First and third party apps and plugins from the marketplace are excluded from this bounty but may be in scope for https://bugcrowd.com/atlassianapps","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6b03c2c9-60b3-4913-816c-54a15e5b9015","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9104797b-3603-44c7-9200-f852bb3f12b9"}],"recentChangeFlags":null},{"id":"639ea3f0-b654-475c-9b58-d286647e70df","uri":"https://shop.atlassian.com","name":"shop.atlassian.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d1efb5b1-ccf8-434a-a58b-654b4a71c137","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"639ea3f0-b654-475c-9b58-d286647e70df"}],"recentChangeFlags":null},{"id":"4abaf21b-99ed-4de1-ae17-6da84cd2570e","uri":null,"name":" bytebucket.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"55c82390-3da6-4031-9178-6fc1bb83b89d","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4abaf21b-99ed-4de1-ae17-6da84cd2570e"}],"recentChangeFlags":null},{"id":"ff4c2133-08ca-4eec-9a3c-ee77eef1002a","uri":null,"name":"*.bitbucket.io","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f117ec2e-683d-4828-bf27-456182740027","sortOrder":0},"sortOrder":0,"tags":[{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"ff4c2133-08ca-4eec-9a3c-ee77eef1002a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ff4c2133-08ca-4eec-9a3c-ee77eef1002a"},{"id":"e591e8bc-d7f4-49ad-952f-98dee6c92653","name":"DNS","targetId":"ff4c2133-08ca-4eec-9a3c-ee77eef1002a"}],"recentChangeFlags":null},{"id":"ee25049d-0672-4e29-ac8b-74d5842aa2cc","uri":null,"name":"https://blog.bitbucket.org","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e519cb29-c2ce-4a0a-b212-edd85a043244","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ee25049d-0672-4e29-ac8b-74d5842aa2cc"}],"recentChangeFlags":null},{"id":"79f19ec9-d755-415c-9324-2aae1b422a55","uri":null,"name":"HipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"be57f025-cb54-410a-8132-c183cfaaef37","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"735694f1-1e75-4712-a5aa-91bc6e3d6914","uri":null,"name":"Stride (inc. Stride Video, Stride Desktop, Stride Mobile)","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"76ec6b8a-2b6b-4d08-8b66-c5a6a1ff9dc3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4ab33371-acd2-48f9-ac4c-ab5de9824d55","uri":"https://support.atlassian.com","name":"support.atlassian.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bf1a7c2d-2c5d-4632-b0b7-dbbb33c2bd5b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"c9d3436a-342b-4a11-8cde-ebc72d8c22ca","uri":"","name":"Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of \u003ccustomer\u003e.atlassian.net or \u003ccustomer\u003e.jira.com. Test only your own instances.","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"35f70ec7-6b97-4ef2-9385-da1e4da98133","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"34a5266f-d2fc-4fbb-979e-63052be172c7","uri":null,"name":"Any repository that you are not an owner of - do not impact Atlassian customers in any way.","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fd726a82-3bec-4f7e-ad03-41c8d9428c2a","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"34a5266f-d2fc-4fbb-979e-63052be172c7"}],"recentChangeFlags":null},{"id":"ce930b2a-65d6-48ca-a531-f86a2e675235","uri":"https://support.loom.com","name":"support.loom.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9bf88550-92f0-4db6-a473-ab983c1c34c5","sortOrder":11},"sortOrder":11,"tags":null,"recentChangeFlags":null},{"id":"c0b7377c-2283-406a-b17f-c16d8644a08f","uri":"https://info.loom.com/","name":"info.loom.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2d777e16-9238-405b-b40b-aa2e72a7dbc8","sortOrder":12},"sortOrder":12,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":6,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d5e162c9-4d2f-47e7-b8f4-f8dcbde936f9","code":"atlassian","state":"in_progress","endsAt":null,"bountyId":"bdc77ad4-eb1d-4ec7-bf28-ee28a9cb04c4","startsAt":"2023-11-06T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/28c0/23ec/6022bc42/ddca52b471e3ce27a2d600c0b9285b1b_bounty-logo-atlassian.png","logoBackgroundColor":"#0052CC","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-11-06T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/atlassian","changelogs":"/engagements/atlassian/changelog","submissions":null,"announcements":"/engagements/atlassian/announcements","hallOfFame":"/engagements/atlassian/hall_of_fames","crowdstream":"/engagements/atlassian/crowdstream"},"announcementsCount":25,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/atlassian/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=atlassian\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/atlassian/engagement_subscribers","engagementChangelogsUrl":"/engagements/atlassian/changelog","publishedAt":"2026-06-12T17:55:38.297Z","engagementChangelogUrl":"/engagements/atlassian/changelog/c31ec9fd-9fff-4aa1-9b4e-aa9929f1086a","createUserFeedbacksUrl":"/engagements/atlassian/feedbacks","engagementCrowdstreamUrl":"/engagements/atlassian/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}