Requirement Yogi (Bug bounty)

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 9 Nov 2026.

How to install Navigate to this checkout page Complete the form using an URL bugbounty-test-<bugcrowd-name>.atlassian.net and an email @bugcrowdninja.com, Go to Apps -> Find new apps -> Install "Requirement Yogi for Confluence" and "Requirement Yogi for Jira", Use an evaluation license (duration: 1 month), Checkout our Installation Checklist and our Getting started tutorials, More documentation We publish our OpenAPI files, see https://docs.requirementyogi.com/cloud/rest-apis, Our three main apps point to the same backend data: https://confluence.requirementyogi.com (the Confluence app's backend), https://jira.requirementyogi.com (the Jira app's backend), and https://app.requirementyogi.com (the standalone app). Definitions "Data" means the contents of requirements, usernames, emails, contents (including the title) of pages, contents (including the title) of issues, "Metadata" means the issue keys, requirement keys, space keys, space ids, page ids, names of categories, etc. "Long" means an integer with a length of 64 bits. Vulnerability ranking P1 - Theft of secrets, RCE Vulnerabilities that allow Remote Code Execution. Vulnerabilities that allow an attacker to impersonate the app to access data hosted by Atlassian without using our servers (e.g., Stealing secret tokens). P2 - Cross-tenant security Vulnerabilities that allow an attacker to view or edit Data belonging to another customer. Exclusion: Metadata, as defined in the "Definitions" section (downgraded as P4), Exclusion: Data access vulnerabilities that rely on brute-forcing a highly entropic UUID or Long are capped at P3, P3 - Same-tenant privilege escalation Vulnerabilities that allow a user to bypass the permission checks and view or edit the data of another user of the same customer. Exclusion: Page restrictions are not used in Requirement Yogi, only space permissions are used. Exclusion: Confluence/Jira permissions are cached for 30 minutes. Exclusion: Metadata, as defined in the "Definitions" section (downgraded as P4), Exclusion: Requirement keys are visible in Jira for any viewer of the issue, even if the user cannot view the requirement. Vulnerabilities that rely on brute-forcing a highly entropic UUID or Long, Vulnerabilities that allow an attacker to display false information to another customer. Example: A reflection vulnerability. Any other vulnerability that is ranked P3 or above on BugCrowd's taxonomy. P4 - Low Vulnerabilities on Metadata, Minor security flaws that affect singular users and require significant user interaction or specific prerequisites like a Man-in-the-Middle (MitM) position, Any vulnerability ranked P4 or above on BugCrowd's taxonomy. P5 - Informational / Non-Exploitable Any vulnerability ranked P5 or above on BugCrowd's taxonomy. Vulnerabilities that can't be immediately exploited, but pose a security risk in other circumstances. Exclusion: The contents of error messages. Note: These vulnerabilities will often be downgraded if we have already mitigated against this risk. Examples: Remote code execution which didn't succeed to access sensitive information, access to database credentials but the database is properly isolated in a private network. Rules, Exclusions, and Scopes Please only test using instances with the URL bugbounty-test-<bugcrowd-name>.atlassian.net. Please do not create additional instances outside of this namespace for testing. Do not test marketplace.atlassian.com, but install our apps and test the apps themselves. Do not post reviews for our apps on marketplace.atlassian.com. Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program. Any domain/property of Requirement Yogi not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). Out-of-Scope Anything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. Specifically for Requirement Yogi: Page-level restrictions are not applied. Requirements on a restricted page are visible to everyone in the space. Confluence administrators can always view all requirements, It is possible to change images inside of a requirement by pointing to a URL and swapping the image under the URL, Permissions (retrieved from Confluence or Jira) are cached for 30 minutes (as mentioned in P4), It is possible to view all requirement keys as a simple user with access to Confluence, but not their content. To help avoid grey areas, below are examples of what is considered out of scope. Blind XSS must not return any user data that you do not have access to (e.g. Screen shots, cookies that aren't owned by you, etc); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your webserver, etc). When testing, please exercise caution if injecting on any form that may be publicly visible - such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with support@bugcrowd before performing the testing. No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues. Any Requirement Yogi website is out of scope for this bounty unless it is a subdomain directly accessible from one of the targets or any associated services attached to the instance. Customer cloud instances and data are explicitly out of scope. Any repository that you are not an owner of - do not impact Requirement Yogi or Atlassian customers in any way. Only the latest version of our products are eligible for a reward. Any internal or development services. The following finding types are specifically excluded from the bounty: Lack of Rate Limiting on any of the targets. The use of high-volume,