What this record establishes
Reviewed policy
An individually reviewed public policy is linked to this program page.
Read the reviewed policy profile →
Official directory card labeled Bug Bounty. Monetary reward displayed. Program policy and submission status not reviewed.
Published asset scope
Snapshot captured 2026-10-03. Scope status: Captured.
| Asset | Type | Group / eligibility |
|---|---|---|
Atlassian Guard Standard and Premium (https://admin.atlassian.com/atlassian-guard)Published location: https://admin.atlassian.com/atlassian-guard | website | Tier 1 |
Atlassian Admin (https://admin.atlassian.com/)Published location: https://admin.atlassian.com/ | website | Tier 1 |
Atlassian Identity (https://id.atlassian.com/login)Published location: https://id.atlassian.com/login | website | Tier 1 |
Atlassian Start (https://start.atlassian.com)Published location: https://start.atlassian.com | website | Tier 1 |
Bitbucket Cloud including Bitbucket Pipelines (https://bitbucket.org)Published location: https://bitbucket.org | website | Tier 1 |
Confluence Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)Published location: https://www.atlassian.com/software/confluence | website | Tier 1 |
Confluence Cloud Premium (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)Published location: https://www.atlassian.com/software/confluence/premium | website | Tier 1 |
Confluence Cloud Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US | android | Tier 1 |
Confluence Cloud Mobile App for iOSPublished location: https://apps.apple.com/us/app/confluence-cloud/id1006971684 | ios | Tier 1 |
Jira Cloud Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US | android | Tier 1 |
Jira Cloud Mobile App for iOSPublished location: https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087 | ios | Tier 1 |
Jira Service Management Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira/service-management | website | Tier 1 |
Jira Software Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira | website | Tier 1 |
Jira Work Management Cloud formerly Jira Core (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira/work-management | website | Tier 1 |
Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance | other | Tier 1 |
RovoPublished location: https://www.atlassian.com/software/rovo | website | Rovo, Rovo Dev and other AI Features |
Rovo Dev CLIPublished location: https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/ | other | Rovo, Rovo Dev and other AI Features |
Other Rovo DevPublished location: https://www.atlassian.com/software/rovo-dev | website | Rovo, Rovo Dev and other AI Features |
Atlassian MCP ServerPublished location: https://mcp.atlassian.com | other | Rovo, Rovo Dev and other AI Features |
Atlassian Marketplace (https://marketplace.atlassian.com)Published location: https://marketplace.atlassian.com | website | Tier 2 |
Atlassian AtlasPublished location: https://www.atlassian.com/software/atlas | website | Tier 2 |
*.atlastunnel.comPublished location: https://*.atlastunnel.com | website | Tier 2 |
Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance | website | Tier 2 |
*.loom.comPublished location: https://www.loom.com/ | website | Atlassian Loom |
Loom Desktop App (Windows)Published location: https://www.loom.com/download | website | Atlassian Loom |
Loom Desktop App (macOS)Published location: https://www.loom.com/download | website | Atlassian Loom |
Loom for AndroidPublished location: https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1 | android | Atlassian Loom |
Loom for iOSPublished location: https://apps.apple.com/us/app/loom-screen-recorder/id1474480829 | ios | Atlassian Loom |
Loom Chrome ExtensionPublished location: https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pli=1 | other | Atlassian Loom |
Atlassian CompassPublished location: https://www.atlassian.com/software/compass | website | Tier 3 |
BambooPublished location: https://www.atlassian.com/software/bamboo | website | Tier 3 |
Bitbucket Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/bitbucket | website | Tier 3 |
Confluence Companion App for macOS and WindowsPublished location: https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html | other | Tier 3 |
Confluence Data Center Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.confluence.server | android | Tier 3 |
Confluence Data Center Mobile App for iOSPublished location: https://apps.apple.com/us/app/confluence-server/id1288365159 | ios | Tier 3 |
CruciblePublished location: https://www.atlassian.com/software/crucible | website | Tier 3 |
Confluence Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/confluence | other | Tier 3 |
CrowdPublished location: https://www.atlassian.com/enterprise/data-center/crowd | website | Tier 3 |
FishEyePublished location: https://www.atlassian.com/software/fisheye | website | Tier 3 |
Jira Core Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira | website | Tier 3 |
Jira Data Center Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.jira.server&hl=en_US&gl=US | android | Tier 3 |
Jira Data Center Mobile App for iOSPublished location: https://apps.apple.com/us/app/jira-server/id1405353949 | ios | Tier 3 |
Jira Product DiscoveryPublished location: https://www.atlassian.com/software/jira/product-discovery | website | Tier 3 |
Jira Service Management Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira/service-management | website | Tier 3 |
Jira Software Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira | website | Tier 3 |
Sourcetree for macOS and Windows (https://www.sourcetreeapp.com/)Published location: https://www.sourcetreeapp.com/ | other | Tier 3 |
Other - (all other Atlassian targets) | other | Tier 3 |
Forge Platform | other | Atlassian Forge |
GraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql) | api | Atlassian Forge |
https://www.npmjs.com/package/@forge/cliPublished location: https://www.npmjs.com/package/@forge/cli | other | Atlassian Forge |
| Asset | Type | Group / eligibility |
|---|---|---|
Any internal or development services. | website | Out of Scope |
First and third party apps and plugins from the marketplace are excluded from this bounty but may be in scope for https://bugcrowd.com/atlassianappsPublished location: https://bugcrowd.com/atlassianapps | website | Out of Scope |
shop.atlassian.comPublished location: https://shop.atlassian.com | website | Out of Scope |
bytebucket.org | website | Out of Scope |
*.bitbucket.io | website | Out of Scope |
https://blog.bitbucket.org | website | Out of Scope |
HipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile) | other | Out of Scope |
Stride (inc. Stride Video, Stride Desktop, Stride Mobile) | other | Out of Scope |
support.atlassian.comPublished location: https://support.atlassian.com | website | Out of Scope |
Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of <customer>.atlassian.net or <customer>.jira.com. Test only your own instances. | website | Out of Scope |
Any repository that you are not an owner of - do not impact Atlassian customers in any way. | website | Out of Scope |
support.loom.comPublished location: https://support.loom.com | website | Out of Scope |
info.loom.comPublished location: https://info.loom.com/ | website | Out of Scope |
Capture limits
- Full policy and announcement reviewed in the cloud browser; web text retrieval supplied only a login shell.
- Program charts use dollar signs; USD normalization relies on official Bugcrowd accounting documentation describing reward transactions, not an explicit ISO code in this brief.
- Policy displayed June 12, 2026 update. Summaries omit asset lists and are not exhaustive.
- Published target group rows were captured; group descriptions, rules and exclusions may further narrow permitted research.
Live policy and platform eligibility still require review.
Sources and collection identity
- Official program page Primary source · reviewed 2026-10-03
- Published scope source Primary source · reviewed 2026-10-03
Appears in Discovery, Bounty, Bugcrowd, Profile. No identity match is inferred from a shared company name.