Railsware

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 9 Nov 2026.

This bounty is part of the Atlassian Marketplace Bounty Program We design and develop awesome apps for Web and Mobile Our Core Values: Great products Friends and partners to our clients Respect and understanding Lean mindset From good to great Contribute to the community Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact Railsware or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Please note that the application listed in the target is in scope. The URL (the marketplace page) itself is NOT Quick Links Smart Checklist for Jira Cloud. Enterprise Staging JSON Descriptor Smart Checklist for Jira Cloud. Free Staging JSON Descriptor Note: If the same vulnerability exists in different hosting solutions of a single app, we may pay for this vulnerability once if the codebase and the fix is the same. We reserve the right to make this decision on a case by case basis. Additionally, there are apps that have distinct listings but share the same codebase. In such case we will only pay once across these apps, unless an environmentally unique vulnerability is discovered. Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please see below for deviations. Note: If the same vulnerability exists in different hosting solutions of a single app, we may pay for this vulnerability once if the codebase and the fix is the same. We reserve the right to make this decision on a case by case basis. Additionally, there are apps that have distinct listings but share the same codebase. In such case we will only pay once across these apps, unless an environmentally unique vulnerability is discovered. XSS on Server instances that require administrator privileges will be scored as P5 Informational and awarded points only, as they don't let the attacker compromise Confidentiality, Integrity or Availability any more than they already could as an administrator. Only the latest version of a server product is eligible for a reward. All vulnerabilities/exploits must be proven to work in the latest version of the Atlassian server product.