# Atlassian: bug bounty program on Bugcrowd

> Atlassian is a bug bounty program on Bugcrowd. Bounties range from $100 to $12,000. 50 assets are listed in scope, 50 of them bounty-eligible.

- **Company:** Atlassian
- **Platform:** Bugcrowd
- **Program page:** /engagements/atlassian
- **Pays bounties:** yes
- **Submissions:** open
- **Bounty range:** $100 to $12,000
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/atlassian-2

## Scope

As imported from Bugcrowd on November 6, 2026: 50 assets in scope (50 bounty-eligible), 13 out of scope. The policy page is the authority.

- `*.atlastunnel.com` (website): in scope, bounty-eligible
- `*.loom.com` (website): in scope, bounty-eligible
- `Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance` (other): in scope, bounty-eligible
- `Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance` (website): in scope, bounty-eligible
- `Atlassian Admin (https://admin.atlassian.com/)` (website): in scope, bounty-eligible
- `Atlassian Atlas` (website): in scope, bounty-eligible
- `Atlassian Compass` (website): in scope, bounty-eligible
- `Atlassian Guard Standard and Premium (https://admin.atlassian.com/atlassian-guard)` (website): in scope, bounty-eligible
- `Atlassian Identity (https://id.atlassian.com/login)` (website): in scope, bounty-eligible
- `Atlassian Marketplace (https://marketplace.atlassian.com)` (website): in scope, bounty-eligible
- `Atlassian MCP Server` (other): in scope, bounty-eligible
- `Atlassian Start (https://start.atlassian.com)` (website): in scope, bounty-eligible
- `Bamboo` (website): in scope, bounty-eligible
- `Bitbucket Cloud including Bitbucket Pipelines (https://bitbucket.org)` (website): in scope, bounty-eligible
- `Bitbucket Data Center` (website): in scope, bounty-eligible
- `Confluence Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)` (website): in scope, bounty-eligible
- `Confluence Cloud Mobile App for Android` (android): in scope, bounty-eligible
- `Confluence Cloud Mobile App for iOS` (ios): in scope, bounty-eligible
- `Confluence Cloud Premium (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)` (website): in scope, bounty-eligible
- `Confluence Companion App for macOS and Windows` (other): in scope, bounty-eligible
- `Confluence Data Center` (other): in scope, bounty-eligible
- `Confluence Data Center Mobile App for Android` (android): in scope, bounty-eligible
- `Confluence Data Center Mobile App for iOS` (ios): in scope, bounty-eligible
- `Crowd` (website): in scope, bounty-eligible
- `Crucible` (website): in scope, bounty-eligible
- `FishEye` (website): in scope, bounty-eligible
- `Forge Platform` (other): in scope, bounty-eligible
- `GraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql)` (api): in scope, bounty-eligible
- `https://www.npmjs.com/package/@forge/cli` (other): in scope, bounty-eligible
- `Jira Cloud Mobile App for Android` (android): in scope, bounty-eligible
- `Jira Cloud Mobile App for iOS` (ios): in scope, bounty-eligible
- `Jira Core Data Center` (website): in scope, bounty-eligible
- `Jira Data Center Mobile App for Android` (android): in scope, bounty-eligible
- `Jira Data Center Mobile App for iOS` (ios): in scope, bounty-eligible
- `Jira Product Discovery` (website): in scope, bounty-eligible
- `Jira Service Management Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)` (website): in scope, bounty-eligible
- `Jira Service Management Data Center` (website): in scope, bounty-eligible
- `Jira Software Cloud (bugbounty-test-<bugcrowd-name>.atlassian.net)` (website): in scope, bounty-eligible
- `Jira Software Data Center` (website): in scope, bounty-eligible
- `Jira Work Management Cloud formerly Jira Core (bugbounty-test-<bugcrowd-name>.atlassian.net)` (website): in scope, bounty-eligible
- and 23 more on the BugRater page

## Recent public accepted findings

- November 6, 2026: critical severity on Bamboo, awarded $4,000
- November 6, 2026: high severity on Forge Platform, awarded $2,500
- November 4, 2026: critical severity on *.loom.com
- November 4, 2026: medium severity on Confluence Cloud Premium (bugbounty-test-<bugcrowd-name>.atlassian.net/wiki)
- November 4, 2026: high severity on Bitbucket Data Center, awarded $1,500

---

Generated November 8, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.