Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.

This bounty is part of the Atlassian Marketplace Bounty Program Resolution provides valuable apps for the Atlassian platforms to enrich these platforms and allow teams to reach their full potential. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact Resolution or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Quick Links Out Of Office Assistant for Jira Cloud Language Translation - Jira Service Desk monday.com for Confluence monday.com for Jira HubSpot CRM for Confluence - Hubspot Integration Hubspot Jira CRM Issue Link Integration & Collaboration Google Translation Automation for Jira Issue Language Structure your Jira Scrum - NASA Not Another Standup App SAML Single Sign On (SSO) Jira, SAML/SSO SAML Single Sign On (SSO) Confluence SAML Single Sign On (SSO) Bitbucket SAML Single Sign On (SSO) Bamboo Users Sync & Groups Sync Jira Users Sync & Groups Sync Confluence Users Sync & Groups Sync Bitbucket Users Sync & Groups Sync Bamboo API Token Authentication for Jira API Token Authentication for Confluence API Token Authentication for Bitbucket User Deactivator for Jira User Deactivator for Confluence User Deactivator for Bitbucket Redirects and Vanity URLs for Confluence HTTP Header Authentication for Jira HTTP Header Auth for Confluence AWS Load balancer Authentication (Cognito compatible) Jira AWS ALB and Amazon Cognito Authentication for Confluence AWS ALB and Amazon Cognito Authentication for Confluence AWS ALB and Amazon Cognito Authentication for Jira User Management and License Optimizer for Jira & Confluence Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please see below for deviations.