• $300 – $10,000 per vulnerability

Program stats

  • Vulnerabilities rewarded 367
  • Validation within 6 days 75% of submissions are accepted or rejected within 6 days
  • Average payout $792.30 within the last 3 months

Latest hall of famers

Recently joined this program

1125 total

Trusted by millions, Trello is a visual collaboration tool that creates a shared perspective on any project. Trello’s boards, lists, and cards enable you to organize and prioritize your personal and work life in a fun, flexible, and rewarding way.

Ratings/Rewards and Bounty Rules:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Note: Atlassian uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority.

To qualify for a bounty you must:

  • Report a qualifying vulnerability that is in the scope of our program (also below)
  • Be the first person to report the vulnerability
  • Adhere to our disclosure guidelines (see below)
  • Only test against your own accounts and data
  • Be reasonable with automated scanning methods so as to not degrade services
  • Refrain from disclosing the vulnerability until we've addressed it
  • Communicate with our security team exclusively via Bugcrowd (the security team will be way more impressed by your exploits than our support or social media teams)


You are free to make as many accounts as needed to test on Trello - please ensure that you use your email address.

Disclosure Request Guidance

Submissions that meet the following requirements will be considered for disclosure upon request:

  • The submission has been accepted
  • The reported vulnerability has been fixed and released in production
  • The submission does not regard a customer instance or a customer’s account

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please submit through the Bugcrowd Support Portal. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.