Trello

Trusted by millions, Trello is a visual collaboration tool that creates a shared perspective on any project. Trello’s boards, lists, and cards enable you to organize and prioritize your personal and work life in a fun, flexible, and rewarding way.

Ratings/Rewards and Bounty Rules:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Note: Atlassian uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Atlassian will defer to the CVSS score to determine the priority.

To qualify for a bounty you must:

• Report a qualifying vulnerability that is in the scope of our program (also below)
• Be the first person to report the vulnerability
• Adhere to our disclosure guidelines (see below)
• Only test against your own accounts and data
• Be reasonable with automated scanning methods so as to not degrade services
• Refrain from disclosing the vulnerability until we've addressed it
• Communicate with our security team exclusively via Bugcrowd (the security team will be way more impressed by your exploits than our support or social media teams)

Access/Credentials

You are free to make as many accounts as needed to test on Trello - please ensure that you use your @bugcrowdninja.com email address.

Disclosure Request Guidance

Submissions that meet the following requirements will be considered for disclosure upon request:

• The submission has been accepted
• The reported vulnerability has been fixed and released in production
• The submission does not regard a customer instance or a customer’s account