{"id":"a463c8f2-1492-4087-8d68-ecf85e3d05ae","engagementId":"eb3198ab-1979-4024-b949-12d35836e805","data":{"brief":{"id":"b3ee52ee-371b-4bb9-8d42-e9390670ba98","name":"Stiltsoft","tagline":"Stiltsoft's bug bounty program","description":"\u003cp\u003e\u003cstrong\u003eThis bounty is part of the Atlassian Marketplace Bounty Program\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eStiltsoft is a highly motivated team of developers with rich experience in the Atlassian Ecosystem since 2010. As an Atlassian Platinum Marketplace Partner, we build high-quality apps that extend the capabilities of Confluence, Jira, and Bitbucket, helping businesses streamline their workflows. With 15,000 companies across 80+ countries trusting our solutions, security remains a top priority in everything we do.\u003c/p\u003e\n\n\u003ch4\u003eGet Started (tl;dr version)\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not access, impact, destroy or otherwise negatively impact Stiltsoft or Atlassian customers, or customer data in any way.\u003c/li\u003e\n\u003cli\u003eEnsure that you use your \u003cem\u003e@bugcrowdninja.com\u003c/em\u003e email address.\u003c/li\u003e\n\u003cli\u003ePlease do not test \u003ca href=\"https://marketplace.atlassian.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emarketplace.atlassian.com\u003c/a\u003e, but install our apps in your Jira/Confluence/Bitbucket instance and test the apps themselves.\u003c/li\u003e\n\u003cli\u003eDo not post reviews for our apps on \u003ca href=\"https://marketplace.atlassian.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003emarketplace.atlassian.com\u003c/a\u003e. Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program.\u003c/li\u003e\n\u003cli\u003eEnsure you understand the targets, scopes, exclusions, and rules below.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eQuick Links\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTable Filter and Charts for Confluence (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=datacenter\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTable Filter and Charts for Confluence (Data Center)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1214110/courses-and-quizzes-lms-for-confluence?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCourses and Quizzes - LMS for Confluence (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAwesome Graphs for Bitbucket (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=datacenter\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAwesome Graphs for Bitbucket (Data Center)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1210766/teamcity-integration-for-jira?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTeamCity Integration for Jira (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHandy Macros for Confluence (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence-status-dropdown-formatting?hosting=datacenter\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHandy Macros for Confluence (Data Center)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1222084/spreadsheet-issue-field-editor?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSpreadsheet Issue Field Editor\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1212507/smart-attachments-for-jira?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSmart Attachments for Jira (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1222102/webhook-manager-for-confluence-cloud?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eWebhook Manager for Confluence (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1237512/latex-math-for-confluence?hosting=cloud\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLaTeX Math for Confluence (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1237729/checklist-for-jira-cloud-smart-todo-lists?hosting=cloud\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eChecklist for Jira Cloud | Smart ToDo Lists (Cloud)\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://marketplace.atlassian.com/apps/1899492230/live-tables-from-csv-json-for-confluence?hosting=cloud\u0026amp;tab=overview\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eLive Tables from CSV \u0026amp; JSON for Confluence\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eFocus Areas\u003c/h3\u003e\n\n\u003cp\u003eBelow is a list of some of the vulnerability classes that we are seeking reports for:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCross Instance Data Leakage/Access**\u003c/li\u003e\n\u003cli\u003eServer-side Remote Code Execution (RCE)\u003c/li\u003e\n\u003cli\u003eServer-Side Request Forgery (SSRF)\u003c/li\u003e\n\u003cli\u003eStored/Reflected Cross-site Scripting (XSS)\u003c/li\u003e\n\u003cli\u003eCross-site Request Forgery (CSRF)\u003c/li\u003e\n\u003cli\u003eSQL Injection (SQLi)\u003c/li\u003e\n\u003cli\u003eXML External Entity Attacks (XXE)\u003c/li\u003e\n\u003cli\u003eAccess Control Vulnerabilities (Insecure Direct Object Reference issues, etc)\u003c/li\u003e\n\u003cli\u003ePath/Directory Traversal Issues\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eEnsure you review the out of scope and exclusions list for further details.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. \u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePlease ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under \"Creating your instance\". Any testing/spamming live support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"02370343-bf13-4661-a7a2-caa1c1076ad1","targetsOverview":"\u003ch3\u003eRules, Exclusions, and Scopes\u003c/h3\u003e\n\n\u003cp\u003eAny domain/property of StiltSoft not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eCreating Your Instance\u003c/h2\u003e\n\n\u003ch4\u003eJira + Confluence Cloud\u003c/h4\u003e\n\n\u003cp\u003eResearchers should use the \u003cstrong\u003ebugbounty-test-\u0026lt;bugcrowd-name\u0026gt;.atlassian.net\u003c/strong\u003e namespace provided in the instructions below. Please do not create additional instances outside of this namespace for testing.\u003c/p\u003e\n\n\u003cp\u003eTo access the instance and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the below steps:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eNavigate to the checkout page \u003ca href=\"https://www.atlassian.com/ondemand/signup/form?product=confluence.ondemand,jira-software.ondemand,jira-servicedesk.ondemand\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eClick \"Next\"\u003c/li\u003e\n\u003cli\u003eComplete the form, using the following format: \u003cstrong\u003ebugbounty-test-\u0026lt;bugcrowd-name\u0026gt;\u003c/strong\u003e\nNote that \u0026lt;bugcrowd-name\u0026gt; should be replaced with your own Bugcrowd username \u003c/li\u003e\n\u003cli\u003eClick \"Start now\"\u003c/li\u003e\n\u003cli\u003eOnce your instance has been completed that's it - you can test away.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eСonfluence Data Center\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eNavigate to \u003ca href=\"https://www.atlassian.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ewww.atlassian.com\u003c/a\u003e and download \u003ca href=\"https://www.atlassian.com/software/confluence/download/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eConfluence Data Center\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eInstall the product and generate a trial license for Confluence\u003c/li\u003e\n\u003cli\u003eInstall the \u003ca href=\"https://marketplace.atlassian.com/apps/27447/table-filter-charts-spreadsheets-for-confluence?hosting=datacenter\u0026amp;tab=installation\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTable Filter and Charts for Confluence\u003c/a\u003e app and \u003ca href=\"https://my.atlassian.com/addon/try/com.stiltsoft.confluence.plugin.tablefilter.tablefilter\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003egenerate\u003c/a\u003e a trial license for the app. Please use your \u003ccode\u003e[username]@bugcrowdninja.com\u003c/code\u003e email alias to get the license. \u003c/li\u003e\n\u003cli\u003eStart testing\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eBitbucket Cloud\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eNavigate to \u003ca href=\"https://bitbucket.org/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://bitbucket.org/\u003c/a\u003e and select \"Log In\"\u003c/li\u003e\n\u003cli\u003eSelect \"Sign Up\" and create an account with your @bugcrowdninja.com email address.\u003c/li\u003e\n\u003cli\u003eInstall the \u003ca href=\"https://docs.stiltsoft.com/display/AwesomeGraphsBitbucket/Installing+Awesome+Graphs+for+Bitbucket+Cloud\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAwesome Graphs\u003c/a\u003e app\u003c/li\u003e\n\u003cli\u003eStart testing\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eBitbucket Data Center\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eNavigate to \u003ca href=\"https://www.atlassian.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ewww.atlassian.com\u003c/a\u003e and download \u003ca href=\"https://www.atlassian.com/software/bitbucket/enterprise/data-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBitbucket Data Center\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eInstall the product and generate a trial license for Bitbucket\u003c/li\u003e\n\u003cli\u003eInstall the \u003ca href=\"https://docs.stiltsoft.com/awesome-graphs/data-center/getting-started\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eAwesome Graphs for Bitbucket\u003c/a\u003e app and \u003ca href=\"https://my.atlassian.com/addon/try/com.stiltsoft.stash.graphs\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003egenerate\u003c/a\u003e a trial license for the app. Please use your \u003ccode\u003e[username]@bugcrowdninja.com\u003c/code\u003e email alias to get the license. \u003c/li\u003e\n\u003cli\u003eStart testing\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eAnything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However to help avoid grey areas, below are examples of what is considered out of scope.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthenticated access within a Bitbucket instance to contributor identity data through Awesome Graphs for Bitbucket Data Center is out of scope. Contributor records are instance-wide and are not filtered by repository permissions. This includes:\n\n\u003cul\u003e\n\u003cli\u003eemails of registered Bitbucket users already available on Bitbucket profile pages;\u003c/li\u003e\n\u003cli\u003econtributor alias relationships returned by \u003ccode\u003ePOST /rest/awesome-graphs/1.0/contributors/resolve\u003c/code\u003e;\u003c/li\u003e\n\u003cli\u003enames and email values returned by \u003ccode\u003ePOST /rest/awesome-graphs/1.0/contributors/details\u003c/code\u003e, including identities without Bitbucket accounts and values indexed from private-repository commits the requester cannot access.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eViewing the outdated data within the Table Filter and Charts app macros after changing the user permissions is out of scope in the cases below because the user has already viewed or exported the restricted data earlier:\n\n\u003cul\u003e\n\u003cli\u003ethe space exported to PDF or Word\u003c/li\u003e\n\u003cli\u003ethe page tree exported to PDF or Word\u003c/li\u003e\n\u003cli\u003ethe Confluence Server mobile app\u003c/li\u003e\n\u003cli\u003ethe Confluence mobile site\u003c/li\u003e\n\u003cli\u003ethe Table Excerpt Include macro with the Output cached results option enabled.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eYou can edit the storage of a Confluence page where the Handy Poll macro resides. This way, you can change names of variants and fake the voting results. Changes in the page storage will be reflected in the page history. Check the \u003ca href=\"https://docs.stiltsoft.com/display/HMFC/Handy+Macros+Cloud+-+FAQ\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHandy Macros Cloud FAQ\u003c/a\u003e for more details.\u003c/li\u003e\n\u003cli\u003eThe case when a user can get emails of other Bitbucket users through the Awesome Graphs app is out of scope, because any Bitbucket user can get such emails on a user profile page in the Bitbucket Server and Data Center directly.\u003c/li\u003e\n\u003cli\u003eBlind XSS must not return any user data that you do not have access to (e.g. screenshots, cookies that aren't owned by you, etc); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your webserver, etc).\u003c/li\u003e\n\u003cli\u003eWhen testing, please exercise caution if injecting on any form that may be publicly visible - such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with support@bugcrowd before performing the testing. \u003c/li\u003e\n\u003cli\u003eNo pivoting or post-exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues.\u003c/li\u003e\n\u003cli\u003eAny StiltSoft website is out of scope for this bounty unless it is directly accessible from one of the targets or any associated services attached to the instance.\u003c/li\u003e\n\u003cli\u003eCustomer cloud instances and data are explicitly out of scope.\u003c/li\u003e\n\u003cli\u003eAny repository that you are not an owner of - do not impact StiltSoft or Atlassian customers in any way.\u003c/li\u003e\n\u003cli\u003eAny internal or development services.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThe following finding types are specifically excluded from the bounty\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eLack of Rate Limiting on any of the targets.\u003c/li\u003e\n\u003cli\u003eThe use of Automated scanners is strictly prohibited (we have these tools too - don't even think about using them)\u003c/li\u003e\n\u003cli\u003eDescriptive error messages (e.g. Stack Traces, application or server errors).\u003c/li\u003e\n\u003cli\u003eFingerprinting / banner disclosure on common/public services.\u003c/li\u003e\n\u003cli\u003eClickjacking and issues only exploitable through clickjacking.\u003c/li\u003e\n\u003cli\u003eLogout Cross-Site Request Forgery (logout CSRF).\u003c/li\u003e\n\u003cli\u003eContent Spoofing.\u003c/li\u003e\n\u003cli\u003ePresence of application or web browser ‘autocomplete’ or ‘save password’ functionality.\u003c/li\u003e\n\u003cli\u003eLack of Secure/HTTPOnly flags on non-sensitive Cookies.\u003c/li\u003e\n\u003cli\u003eLack of Security Speedbump when leaving the site.\u003c/li\u003e\n\u003cli\u003eWeak Captcha / Captcha Bypass.\u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force and account lockout not enforced.\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration.\u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers, specifically (\u003ca href=\"https://owasp.org/www-project-secure-headers/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://owasp.org/www-project-secure-headers/\u003c/a\u003e), e.g.\n\n\u003cul\u003e\n\u003cli\u003eStrict-Transport-Security.\u003c/li\u003e\n\u003cli\u003eX-Frame-Options.\u003c/li\u003e\n\u003cli\u003eX-XSS-Protection.\u003c/li\u003e\n\u003cli\u003eX-Content-Type-Options.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP.\u003c/li\u003e\n\u003cli\u003eContent-Security-Policy-Report-Only.\u003c/li\u003e\n\u003cli\u003eCache-Control and Pragma\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eHTTP/DNS cache poisoning.\u003c/li\u003e\n\u003cli\u003eSSL/TLS Issues, e.g.\n\n\u003cul\u003e\n\u003cli\u003eSSL Attacks such as BEAST, BREACH, Renegotiation attack.\u003c/li\u003e\n\u003cli\u003eSSL Forward secrecy not enabled.\u003c/li\u003e\n\u003cli\u003eSSL weak/insecure cipher suites.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eSelf-XSS reports will not be accepted.\n\n\u003cul\u003e\n\u003cli\u003eSimilarly, any XSS where local access is required (i.e. User-Agent Header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will allow for the XSS to trigger.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eVulnerabilities that are limited to unsupported browsers will not be accepted (i.e. \"this exploit only works in IE6/IE7\"). A list of supported browsers can be found \u003ca href=\"https://confluence.atlassian.com/display/Cloud/Supported+browsers\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eKnown vulnerabilities in used libraries, or the reports that an Atlassian product uses an outdated third party library (e.g. jQuery, Apache HttpComponents etc) unless you can prove exploitability.\u003c/li\u003e\n\u003cli\u003eMissing or incorrect SPF records of any kind.\u003c/li\u003e\n\u003cli\u003eMissing or incorrect DMARC records of any kind.\u003c/li\u003e\n\u003cli\u003eSource code disclosure vulnerabilities.\u003c/li\u003e\n\u003cli\u003eInformation disclosure of non-confidential information (e. g. issue id, project id, commit hashes).\u003c/li\u003e\n\u003cli\u003eThe ability to upload/download viruses or malicious files to the platform.\u003c/li\u003e\n\u003cli\u003eEmail bombing/Flooding/rate limiting.\u003c/li\u003e\n\u003cli\u003eJWT in ajax requests ignores path and HTTP method.\u003c/li\u003e\n\u003cli\u003eFor some of our apps, we allow arbitrary HTML templates to be defined by administrators. Those could potentially be used for XSS attacks, however since only administrators have access we don't consider those as security threats.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRules\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou must ensure that customer data is not affected in any way as a result of your testing. Please ensure you're being non-destructive whilst testing and are only testing on instances that you own.\u003c/li\u003e\n\u003cli\u003eIn addition to above, customer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or \"verified\")\n\n\u003cul\u003e\n\u003cli\u003eIf you believe you have found sensitive customer data (e.g., login credentials, API keys etc) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eOnly the latest version of a Server or Data Center app is eligible for a reward. All vulnerabilities/exploits must be proven to work in the latest version of the Atlassian Server or Data Center product.\u003c/li\u003e\n\u003cli\u003eAny vulnerability found in a Cloud app is not eligible for a reward in the Server or Data Center app, and vice versa (i.e. no double dipping). The same is applicable for vulnerabilities found in a Server app that are not eligible for a reward in the Data Center app, and vice versa.\u003c/li\u003e\n\u003cli\u003e\n\u003cem\u003eUse of any automated tools/scanners is strictly prohibited\u003c/em\u003e and will lead to you being removed from the program (trust us, we have those tools too).\u003c/li\u003e\n\u003cli\u003eReports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text.\u003c/li\u003e\n\u003cli\u003eGrants/awards are at the discretion of StiltSoft and we withhold the right to grant, modify or deny grants. But we'll be fair about it.\u003c/li\u003e\n\u003cli\u003eTax implications of any payouts are the sole responsibility of the reporter.\u003c/li\u003e\n\u003cli\u003eDo NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure.\u003c/li\u003e\n\u003cli\u003eDo NOT test the physical security of StiltSoft offices, employees, equipment, etc.\u003c/li\u003e\n\u003cli\u003eThis bounty follows Bugcrowd’s standard disclosure terms.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ePublic Disclosure\u003c/h3\u003e\n\n\u003cp\u003eBefore disclosing an issue publicly we require that you first request permission from us. StiltSoft will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without StiltSoft's written consent will have any allocated bounty withdrawn and disqualified from the program.\u003c/p\u003e\n\n\u003ch3\u003eSafe Harbor\u003c/h3\u003e\n\n\u003cp\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eYou are expected, as always, to comply with all applicable laws.\u003cbr\u003e\nIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"38cfbdf9-7a14-480b-8e00-f38bab274e63","name":"High-Priority |  In Scope Targets","targets":[{"id":"1ea57c89-b027-495c-b0d6-9560fe9082c7","uri":"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=cloud","name":"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"86305dd6-7647-4a07-8653-b00f9816b97d","sortOrder":0},"sortOrder":0,"tags":[{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"d2e9f7fd-1403-4a01-b5b8-fba5e0f49e37","name":"ExpressJS","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"1ea57c89-b027-495c-b0d6-9560fe9082c7"}],"recentChangeFlags":null},{"id":"1cfdd120-77c0-4f25-ba0e-23e37babe966","uri":"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"138303b8-b798-44e3-a235-81c91e114af0","sortOrder":4},"sortOrder":4,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"6aa5759f-3c91-49c8-97b8-6eed6d7e5d0d","name":"Git","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"82f40d98-028c-4068-90be-62d1e30c0253","name":"Play","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1cfdd120-77c0-4f25-ba0e-23e37babe966"}],"recentChangeFlags":null},{"id":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7","uri":"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=datacenter","name":"https://marketplace.atlassian.com/apps/1210934/awesome-graphs-for-bitbucket?hosting=datacenter","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0c169d13-9154-4706-a8ca-afc5f8cdc7f0","sortOrder":5},"sortOrder":5,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"6aa5759f-3c91-49c8-97b8-6eed6d7e5d0d","name":"Git","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"a5a8125d-2e24-4979-a994-d67089f0909b","name":"Apache Tomcat","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"13b1f91b-f9cc-4e0e-8be5-d331859bc6f7"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"a99d1919-6fd9-46ff-9c70-f51a993c0c37","p1MaxCents":300000,"p1MinCents":300000,"p2MaxCents":180000,"p2MinCents":180000,"p3MaxCents":60000,"p3MinCents":60000,"p4MaxCents":20000,"p4MinCents":20000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3000,"max":3000},"2":{"min":1800,"max":1800},"3":{"min":600,"max":600},"4":{"min":200,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"67635bf0-4ff9-4c2d-b824-e71b052e6a0f","name":"Other - In Scope Targets","targets":[{"id":"5070e980-0863-4067-8ccf-c4d3b97a641a","uri":"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=datacenter","name":"https://marketplace.atlassian.com/apps/27447/table-filter-and-charts-for-confluence?hosting=datacenter","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4d374e26-4cc7-4cc7-bfc2-715ec7b44f8d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"},{"id":"a5a8125d-2e24-4979-a994-d67089f0909b","name":"Apache Tomcat","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"5070e980-0863-4067-8ccf-c4d3b97a641a"}],"recentChangeFlags":null},{"id":"44a28590-1565-405b-9bbc-1c174c402a23","uri":"https://marketplace.atlassian.com/apps/1212507/smart-attachments-for-jira?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1212507/smart-attachments-for-jira?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9c5f4e6f-e73d-4881-8ab5-53321a7939be","sortOrder":1},"sortOrder":1,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"44a28590-1565-405b-9bbc-1c174c402a23"},{"id":"29b28ccd-4801-41ae-803f-74d103419965","name":"Jira","targetId":"44a28590-1565-405b-9bbc-1c174c402a23"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"44a28590-1565-405b-9bbc-1c174c402a23"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"44a28590-1565-405b-9bbc-1c174c402a23"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"44a28590-1565-405b-9bbc-1c174c402a23"}],"recentChangeFlags":null},{"id":"f3c2602e-821f-48ad-8313-1d5e50b8730f","uri":"https://marketplace.atlassian.com/apps/1222084/spreadsheet-issue-field-editor?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1222084/spreadsheet-issue-field-editor?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"420e55b8-73aa-4b42-a4f1-bc471ede2500","sortOrder":2},"sortOrder":2,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"f3c2602e-821f-48ad-8313-1d5e50b8730f"}],"recentChangeFlags":null},{"id":"33837914-e1a9-48e4-ab8c-583e8d20eb33","uri":"https://marketplace.atlassian.com/apps/1210766/teamcity-integration-for-jira?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1210766/teamcity-integration-for-jira?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"51a268e4-7f87-4ffc-afbc-5f52d59c8ef1","sortOrder":3},"sortOrder":3,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"29b28ccd-4801-41ae-803f-74d103419965","name":"Jira","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"82f40d98-028c-4068-90be-62d1e30c0253","name":"Play","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"},{"id":"eaa69542-87cd-413a-9b74-3e75f9fb01e4","name":"Angular","targetId":"33837914-e1a9-48e4-ab8c-583e8d20eb33"}],"recentChangeFlags":null},{"id":"9e0b96a3-984c-41c6-8c51-e539572d5686","uri":"https://marketplace.atlassian.com/apps/1222102/webhook-manager-for-confluence-cloud?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1222102/webhook-manager-for-confluence-cloud?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"834e8941-b67f-4bee-bdf5-2ed3560b989d","sortOrder":4},"sortOrder":4,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"9e0b96a3-984c-41c6-8c51-e539572d5686"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"9e0b96a3-984c-41c6-8c51-e539572d5686"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"9e0b96a3-984c-41c6-8c51-e539572d5686"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"9e0b96a3-984c-41c6-8c51-e539572d5686"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"9e0b96a3-984c-41c6-8c51-e539572d5686"}],"recentChangeFlags":null},{"id":"52ac8ef4-e4ac-4b2e-9413-c14f2054b5bc","uri":"https://marketplace.atlassian.com/apps/1237512/latex-math-for-confluence?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1237512/latex-math-for-confluence?hosting=cloud","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"067d2e95-1bfb-4bd5-9a3d-de3139d9808d","sortOrder":5},"sortOrder":5,"tags":[{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"52ac8ef4-e4ac-4b2e-9413-c14f2054b5bc"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"52ac8ef4-e4ac-4b2e-9413-c14f2054b5bc"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"52ac8ef4-e4ac-4b2e-9413-c14f2054b5bc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"52ac8ef4-e4ac-4b2e-9413-c14f2054b5bc"}],"recentChangeFlags":null},{"id":"40b251b2-1b54-49c1-b3d8-0b196e2cb7be","uri":"https://marketplace.atlassian.com/apps/1237729/checklist-for-jira-cloud-smart-todo-lists?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1237729/checklist-for-jira-cloud-smart-todo-lists?hosting=cloud","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5be5a55c-239e-4559-995f-8032931ea121","sortOrder":6},"sortOrder":6,"tags":[{"id":"29b28ccd-4801-41ae-803f-74d103419965","name":"Jira","targetId":"40b251b2-1b54-49c1-b3d8-0b196e2cb7be"},{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"40b251b2-1b54-49c1-b3d8-0b196e2cb7be"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"40b251b2-1b54-49c1-b3d8-0b196e2cb7be"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"40b251b2-1b54-49c1-b3d8-0b196e2cb7be"}],"recentChangeFlags":null},{"id":"d5f2d848-0087-4df2-84f6-8dff1f77fefc","uri":"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence-status-dropdown-formatting?hosting=datacenter","name":"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence-status-dropdown-formatting?hosting=datacenter","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8c6ce74b-74b8-4e37-8b41-c1e038fae793","sortOrder":7},"sortOrder":7,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"},{"id":"a5a8125d-2e24-4979-a994-d67089f0909b","name":"Apache Tomcat","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"d5f2d848-0087-4df2-84f6-8dff1f77fefc"}],"recentChangeFlags":null},{"id":"0d258e7b-7813-40de-b79f-53bf94a47651","uri":"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1ea7482d-95ca-4bf1-8af9-8736b0b9f721","sortOrder":8},"sortOrder":8,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"},{"id":"c392035e-469e-4625-a2f9-bbf1ffb873d9","name":"Spring","targetId":"0d258e7b-7813-40de-b79f-53bf94a47651"}],"recentChangeFlags":null},{"id":"960bfa0d-a577-474e-8f35-224b4d747d05","uri":"https://marketplace.atlassian.com/apps/1214110/courses-and-quizzes-lms-for-confluence?hosting=cloud","name":"https://marketplace.atlassian.com/apps/1214110/courses-and-quizzes-lms-for-confluence?hosting=cloud","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0f14ac2b-dbaa-46af-9189-fef07b8e64f5","sortOrder":9},"sortOrder":9,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"45e28558-ada7-4f38-b087-fb0e6ac31e0d","name":"AWS","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"82f40d98-028c-4068-90be-62d1e30c0253","name":"Play","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"960bfa0d-a577-474e-8f35-224b4d747d05"}],"recentChangeFlags":null},{"id":"1848fbae-e164-46b8-aaca-33d059eb652c","uri":"https://marketplace.atlassian.com/apps/1899492230/live-tables-from-csv-json-for-confluence?hosting=cloud\u0026tab=overview","name":"https://marketplace.atlassian.com/apps/1899492230/live-tables-from-csv-json-for-confluence?hosting=cloud\u0026tab=overview","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1e32a90c-e2ef-49ff-8697-3ead131a7340","sortOrder":10},"sortOrder":10,"tags":[{"id":"69f9dcc7-e598-4efc-be48-7c36a7689651","name":"Atlassian Forge","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"85756483-8cbd-4a28-8ec2-e4c59a7981fe","name":"Confluence","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"a634fd4f-7410-4f25-9d18-31f9ce752854","name":"CSS","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"1848fbae-e164-46b8-aaca-33d059eb652c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"c834570f-26c6-44e1-9bba-5edeaba825fa","p1MaxCents":150000,"p1MinCents":150000,"p2MaxCents":90000,"p2MinCents":90000,"p3MaxCents":30000,"p3MinCents":30000,"p4MaxCents":10000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1500,"max":1500},"2":{"min":900,"max":900},"3":{"min":300,"max":300},"4":{"min":100,"max":100},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"b9737ec6-ed43-434a-9a5e-a5f8f83c3c95","name":"Out of Scope","targets":[{"id":"050c5467-c343-4adb-9e08-594c6b4d4624","uri":"https://*.atlassian.com","name":"*.atlassian.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"71b0701a-fad7-4930-a882-ebc6c4e728b4","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"eb3198ab-1979-4024-b949-12d35836e805","code":"stiltsoft","state":"in_progress","endsAt":null,"bountyId":"5994be55-c805-44f2-a4de-afb51a6aa1bc","startsAt":"2020-07-14T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Computer Software","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/7e2c/8219/7d610da3/e56919fc4eae2f963694e5ab9c388886_Stiltsoft_Znak_Orange.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-07-14T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/stiltsoft","changelogs":"/engagements/stiltsoft/changelog","submissions":null,"announcements":"/engagements/stiltsoft/announcements","hallOfFame":"/engagements/stiltsoft/hall_of_fames","crowdstream":"/engagements/stiltsoft/crowdstream"},"announcementsCount":7,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/stiltsoft/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=stiltsoft\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/stiltsoft/engagement_subscribers","engagementChangelogsUrl":"/engagements/stiltsoft/changelog","publishedAt":"2026-09-26T12:23:26.932Z","engagementChangelogUrl":"/engagements/stiltsoft/changelog/a463c8f2-1492-4087-8d68-ecf85e3d05ae","createUserFeedbacksUrl":"/engagements/stiltsoft/feedbacks","engagementCrowdstreamUrl":"/engagements/stiltsoft/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}