Mattermost Public Bug Bounty Engagement

At a glance#

• Maximum payout: $2,000
• Public disclosure: Not allowed
• Managed by the platform: Yes
• Safe harbour: Full

In scope#

• https://play.google.com/store/search?q=mattermost&c=apps
• https://apps.apple.com/us/app/mattermost/id1257222717
• https://mattermost.com/apps/
• https://bugcrowd-*your-own-instance*.cloud.mattermost.com/
• https://github.com/mattermost/mattermost-plugin-jira
• https://github.com/mattermost/mattermost-plugin-zoom
• https://github.com/mattermost/mattermost-plugin-github
• https://github.com/mattermost/mattermost-plugin-gitlab
• https://github.com/mattermost/mattermost-plugin-calls
• https://github.com/mattermost/mattermost-plugin-playbooks
• https://github.com/mattermost/mattermost-plugin-boards
• https://github.com/mattermost/mattermost-plugin-ai
• https://github.com/mattermost/mattermost-plugin-mscalendar
• https://github.com/mattermost/mattermost-plugin-msteams-meetings
• https://github.com/mattermost/mattermost-plugin-confluence
• https://github.com/mattermost/mattermost-plugin-msteams

Out of scope#

• about.mattermost.com
• integrations.mattermost.com
• docs.mattermost.com
• academy.mattermost.com
• developers.mattermost.com
• forum.mattermost.com
• mattermost.com (the main website)

Imported from the public directory. Always confirm scope on the official program page before testing.