PentestingHere
Log in Join

Atlassian

Atlassian on Bugcrowd · Bugcrowd Active

Official page
Not rated be the first 0 Researchers 0 Findings 0 Reviews Feedback

Scope

At a glance

  • Maximum payout: $12,000
  • Public disclosure: Not allowed
  • Managed by the platform: Yes
  • Safe harbour: Full

In scope

  • https://admin.atlassian.com/atlassian-guard
  • https://admin.atlassian.com/
  • https://id.atlassian.com/login
  • https://start.atlassian.com
  • https://bitbucket.org
  • https://www.atlassian.com/software/confluence
  • https://www.atlassian.com/software/confluence/premium
  • https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US
  • https://apps.apple.com/us/app/confluence-cloud/id1006971684
  • https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US
  • https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087
  • https://www.atlassian.com/software/jira/service-management
  • https://www.atlassian.com/software/jira
  • https://www.atlassian.com/software/jira/work-management
  • Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance
  • https://www.atlassian.com/software/rovo
  • https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/
  • https://www.atlassian.com/software/rovo-dev
  • https://mcp.atlassian.com
  • https://marketplace.atlassian.com
  • https://www.atlassian.com/software/atlas
  • https://*.atlastunnel.com
  • Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance
  • https://www.loom.com/
  • https://www.loom.com/download
  • https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1
  • https://apps.apple.com/us/app/loom-screen-recorder/id1474480829
  • https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pli...
  • https://www.atlassian.com/software/compass
  • https://www.atlassian.com/software/bamboo
  • https://www.atlassian.com/enterprise/data-center/bitbucket
  • https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html
  • https://play.google.com/store/apps/details?id=com.atlassian.confluence.server
  • https://apps.apple.com/us/app/confluence-server/id1288365159
  • https://www.atlassian.com/software/crucible
  • https://www.atlassian.com/enterprise/data-center/confluence
  • https://www.atlassian.com/enterprise/data-center/crowd
  • https://www.atlassian.com/software/fisheye
  • https://www.atlassian.com/enterprise/data-center/jira
  • https://play.google.com/store/apps/details?id=com.atlassian.jira.server&hl=en_US&gl=US

8 more assets on the official page.

Out of scope

  • Any internal or development services.
  • https://bugcrowd.com/atlassianapps
  • https://shop.atlassian.com
  • bytebucket.org
  • *.bitbucket.io
  • https://blog.bitbucket.org
  • HipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile)
  • Stride (inc. Stride Video, Stride Desktop, Stride Mobile)
  • https://support.atlassian.com
  • Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the fo...
  • Any repository that you are not an owner of - do not impact Atlassian customers in any way.
  • https://support.loom.com
  • https://info.loom.com/

Imported from the public directory. Always confirm scope on the official program page before testing.

Is it worth your time?

Read the community feedback

0 reviews rating communication, triage, payouts and whether it suits beginners.

Open feedback