Decadis AG

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 23 Oct 2026.

This bounty is part of the Atlassian Marketplace Bounty Program Being an Atlassian Platinum Solution Partner in addition to our role as an Atlassian Marketplace Vendor, our primary goal is to develop apps that make the work of administrators and end users easier and that allow them to tap the full potential of the Atlassian tools. This program targets the complete Cloud portfolio of our apps being available on the Atlassian Marketplace. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact Decadis AG or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Please note that the application listed in the target is in scope. The URL (the Marketplace page) itself is NOT. Quick Links Please see our documentation: Jira Workflow Toolbox for Jira Cloud -https://go.decadis.net/jwtc/ sumUp for Jira Cloud - https://go.decadis.net/sumcloud/documentation Advanced Formula Fields - Calculated Custom Fields for Jira - https://go.decadis.net/sf4j Please note that in the context of our documentation, the abbreviation JWT is referred to as Jira Workflow Toolbox instead of JSON Web Tokens if not stated otherwise. Jira Workflow Toolbox sumUp for Jira Advanced Formula Fields Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please see below for deviations.