Policy and restrictions
No customer data, others’ repositories, credential validation, automated scanners, social engineering, physical attacks or post-exploitation pivoting. Cloud denial-of-service and low-impact categories are excluded. Plain-text reports and permission before disclosure are required; safe harbor is conditional.
Eligibility and submission status
First valid previously unknown report for cash eligibility. Designated researcher accounts, owned instances and latest applicable product versions are required.
Official page displayed In progress and an ongoing period; eligibility and current restrictions still apply.
Advertised rewards
Tier-dependent advertised awards span $100–$12,000. Product/severity schedules differ and awards are discretionary. April 16, 2026 updates raised top-tier P1/P2 awards and reduced P3/P4 awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
Atlassian Guard Standard and Premium (https://admin.atlassian.com/atlassian-guard)Published location: https://admin.atlassian.com/atlassian-guard | website | Tier 1 |
Atlassian Admin (https://admin.atlassian.com/)Published location: https://admin.atlassian.com/ | website | Tier 1 |
Atlassian Identity (https://id.atlassian.com/login)Published location: https://id.atlassian.com/login | website | Tier 1 |
Atlassian Start (https://start.atlassian.com)Published location: https://start.atlassian.com | website | Tier 1 |
Bitbucket Cloud including Bitbucket Pipelines (https://bitbucket.org)Published location: https://bitbucket.org | website | Tier 1 |
Confluence Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)Published location: https://www.atlassian.com/software/confluence | website | Tier 1 |
Confluence Cloud Premium (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)Published location: https://www.atlassian.com/software/confluence/premium | website | Tier 1 |
Confluence Cloud Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US | android | Tier 1 |
Confluence Cloud Mobile App for iOSPublished location: https://apps.apple.com/us/app/confluence-cloud/id1006971684 | ios | Tier 1 |
Jira Cloud Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US | android | Tier 1 |
Jira Cloud Mobile App for iOSPublished location: https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087 | ios | Tier 1 |
Jira Service Management Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira/service-management | website | Tier 1 |
Jira Software Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira | website | Tier 1 |
Jira Work Management Cloud formerly Jira Core (bugbounty-test-<bugcrowd-name>.atlassian.net)Published location: https://www.atlassian.com/software/jira/work-management | website | Tier 1 |
Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance | other | Tier 1 |
RovoPublished location: https://www.atlassian.com/software/rovo | website | Rovo, Rovo Dev and other AI Features |
Rovo Dev CLIPublished location: https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/ | other | Rovo, Rovo Dev and other AI Features |
Other Rovo DevPublished location: https://www.atlassian.com/software/rovo-dev | website | Rovo, Rovo Dev and other AI Features |
Atlassian MCP ServerPublished location: https://mcp.atlassian.com | other | Rovo, Rovo Dev and other AI Features |
Atlassian Marketplace (https://marketplace.atlassian.com)Published location: https://marketplace.atlassian.com | website | Tier 2 |
Atlassian AtlasPublished location: https://www.atlassian.com/software/atlas | website | Tier 2 |
*.atlastunnel.comPublished location: https://*.atlastunnel.com | website | Tier 2 |
Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance | website | Tier 2 |
*.loom.comPublished location: https://www.loom.com/ | website | Atlassian Loom |
Loom Desktop App (Windows)Published location: https://www.loom.com/download | website | Atlassian Loom |
Loom Desktop App (macOS)Published location: https://www.loom.com/download | website | Atlassian Loom |
Loom for AndroidPublished location: https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1 | android | Atlassian Loom |
Loom for iOSPublished location: https://apps.apple.com/us/app/loom-screen-recorder/id1474480829 | ios | Atlassian Loom |
Loom Chrome ExtensionPublished location: https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pli=1 | other | Atlassian Loom |
Atlassian CompassPublished location: https://www.atlassian.com/software/compass | website | Tier 3 |
BambooPublished location: https://www.atlassian.com/software/bamboo | website | Tier 3 |
Bitbucket Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/bitbucket | website | Tier 3 |
Confluence Companion App for macOS and WindowsPublished location: https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html | other | Tier 3 |
Confluence Data Center Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.confluence.server | android | Tier 3 |
Confluence Data Center Mobile App for iOSPublished location: https://apps.apple.com/us/app/confluence-server/id1288365159 | ios | Tier 3 |
CruciblePublished location: https://www.atlassian.com/software/crucible | website | Tier 3 |
Confluence Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/confluence | other | Tier 3 |
CrowdPublished location: https://www.atlassian.com/enterprise/data-center/crowd | website | Tier 3 |
FishEyePublished location: https://www.atlassian.com/software/fisheye | website | Tier 3 |
Jira Core Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira | website | Tier 3 |
Jira Data Center Mobile App for AndroidPublished location: https://play.google.com/store/apps/details?id=com.atlassian.jira.server&hl=en_US&gl=US | android | Tier 3 |
Jira Data Center Mobile App for iOSPublished location: https://apps.apple.com/us/app/jira-server/id1405353949 | ios | Tier 3 |
Jira Product DiscoveryPublished location: https://www.atlassian.com/software/jira/product-discovery | website | Tier 3 |
Jira Service Management Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira/service-management | website | Tier 3 |
Jira Software Data CenterPublished location: https://www.atlassian.com/enterprise/data-center/jira | website | Tier 3 |
Sourcetree for macOS and Windows (https://www.sourcetreeapp.com/)Published location: https://www.sourcetreeapp.com/ | other | Tier 3 |
Other - (all other Atlassian targets) | other | Tier 3 |
Forge Platform | other | Atlassian Forge |
GraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql) | api | Atlassian Forge |
https://www.npmjs.com/package/@forge/cliPublished location: https://www.npmjs.com/package/@forge/cli | other | Atlassian Forge |
| Asset | Type | Group / eligibility |
|---|---|---|
Any internal or development services. | website | Out of Scope |
First and third party apps and plugins from the marketplace are excluded from this bounty but may be in scope for https://bugcrowd.com/atlassianappsPublished location: https://bugcrowd.com/atlassianapps | website | Out of Scope |
shop.atlassian.comPublished location: https://shop.atlassian.com | website | Out of Scope |
bytebucket.org | website | Out of Scope |
*.bitbucket.io | website | Out of Scope |
https://blog.bitbucket.org | website | Out of Scope |
HipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile) | other | Out of Scope |
Stride (inc. Stride Video, Stride Desktop, Stride Mobile) | other | Out of Scope |
support.atlassian.comPublished location: https://support.atlassian.com | website | Out of Scope |
Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of <customer>.atlassian.net or <customer>.jira.com. Test only your own instances. | website | Out of Scope |
Any repository that you are not an owner of - do not impact Atlassian customers in any way. | website | Out of Scope |
support.loom.comPublished location: https://support.loom.com | website | Out of Scope |
info.loom.comPublished location: https://info.loom.com/ | website | Out of Scope |
Review limitations
- Full policy and announcement reviewed in the cloud browser; web text retrieval supplied only a login shell.
- Program charts use dollar signs; USD normalization relies on official Bugcrowd accounting documentation describing reward transactions, not an explicit ISO code in this brief.
- Policy displayed June 12, 2026 update. Summaries omit asset lists and are not exhaustive.
Sources and provenance
- Atlassian program brief Atlassian / Bugcrowd · reviewed 2026-10-02
- Atlassian program announcements Atlassian / Bugcrowd · reviewed 2026-10-02
- Bugcrowd fund management overview Bugcrowd · reviewed 2026-10-02
- Getting rewarded Bugcrowd · reviewed 2026-10-02
- Published Bugcrowd scope groups Atlassian · reviewed 2026-10-03
Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.