# Mattermost Public Bug Bounty Engagement: bug bounty program on Bugcrowd

> Mattermost Public Bug Bounty Engagement is a bug bounty program on Bugcrowd. Bounties range from $150 to $2,000. 16 assets are listed in scope, 16 of them bounty-eligible.

- **Company:** Mattermost Public Bug Bounty Engagement
- **Platform:** Bugcrowd
- **Program page:** /engagements/mattermost-mbb-public
- **Pays bounties:** yes
- **Submissions:** open
- **Bounty range:** $150 to $2,000
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/mattermost-mbb-public

## Scope

As imported from Bugcrowd on November 6, 2026: 16 assets in scope (16 bounty-eligible), 7 out of scope. The policy page is the authority.

- `https://bugcrowd-*your-own-instance*.cloud.mattermost.com/` (website): in scope, bounty-eligible
- `Mattermost Boards Plugin` (other): in scope, bounty-eligible
- `Mattermost Calls Plugin` (other): in scope, bounty-eligible
- `Mattermost Confluence Plugin` (other): in scope, bounty-eligible
- `Mattermost Copilot Plugin` (other): in scope, bounty-eligible
- `Mattermost Desktop Apps` (other): in scope, bounty-eligible
- `Mattermost Github Plugin` (other): in scope, bounty-eligible
- `Mattermost Gitlab Plugin` (other): in scope, bounty-eligible
- `Mattermost Jira Plugin` (other): in scope, bounty-eligible
- `Mattermost Microsoft Calendar Plugin` (other): in scope, bounty-eligible
- `Mattermost Mobile Android` (android): in scope, bounty-eligible
- `Mattermost Mobile iOS` (ios): in scope, bounty-eligible
- `Mattermost MSTeams Plugin` (other): in scope, bounty-eligible
- `Mattermost Playbooks Plugin` (other): in scope, bounty-eligible
- `Mattermost Plugin for Microsoft Teams Meetings` (other): in scope, bounty-eligible
- `Mattermost Zoom Plugin` (other): in scope, bounty-eligible
- `about.mattermost.com` (website): out of scope
- `academy.mattermost.com` (website): out of scope
- `developers.mattermost.com` (website): out of scope
- `docs.mattermost.com` (website): out of scope
- `forum.mattermost.com` (website): out of scope
- `integrations.mattermost.com` (website): out of scope
- `mattermost.com (the main website)` (website): out of scope

## Recent public accepted findings

- November 6, 2026: medium severity on Mattermost Jira Plugin, awarded $300
- November 6, 2026: medium severity on Mattermost Copilot Plugin, awarded $300
- November 5, 2026: low severity on Mattermost Github Plugin, awarded $150
- November 5, 2026: medium severity on https://bugcrowd-*your-own-instance*.cloud.mattermost.com/, awarded $300
- November 4, 2026: medium severity, awarded $300

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.