AT
BugcrowdOffers Rewards
Atlassian
Atlassian appears to run a bug bounty or vulnerability disclosure program on Bugcrowd. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (48)
https://admin.atlassian.com/atlassian-guard
https://admin.atlassian.com/
https://id.atlassian.com/login
https://start.atlassian.com
https://bitbucket.org
https://www.atlassian.com/software/confluence
https://www.atlassian.com/software/confluence/premium
https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US
https://apps.apple.com/us/app/confluence-cloud/id1006971684
https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US
https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087
https://www.atlassian.com/software/jira/service-management
https://www.atlassian.com/software/jira
https://www.atlassian.com/software/jira/work-management
Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance
https://www.atlassian.com/software/rovo
https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/
https://www.atlassian.com/software/rovo-dev
https://mcp.atlassian.com
https://marketplace.atlassian.com
https://www.atlassian.com/software/atlas
https://*.atlastunnel.com
Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance
https://www.loom.com/
https://www.loom.com/download
https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1
https://apps.apple.com/us/app/loom-screen-recorder/id1474480829
https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pli=1
https://www.atlassian.com/software/compass
https://www.atlassian.com/software/bamboo
https://www.atlassian.com/enterprise/data-center/bitbucket
https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html
https://play.google.com/store/apps/details?id=com.atlassian.confluence.server
https://apps.apple.com/us/app/confluence-server/id1288365159
https://www.atlassian.com/software/crucible
https://www.atlassian.com/enterprise/data-center/confluence
https://www.atlassian.com/enterprise/data-center/crowd
https://www.atlassian.com/software/fisheye
https://www.atlassian.com/enterprise/data-center/jira
https://play.google.com/store/apps/details?id=com.atlassian.jira.server&hl=en_US&gl=US
https://apps.apple.com/us/app/jira-server/id1405353949
https://www.atlassian.com/software/jira/product-discovery
https://www.atlassian.com/enterprise/data-center/jira/service-management
https://www.sourcetreeapp.com/
Other - (all other Atlassian targets)
Forge Platform
GraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql)
https://www.npmjs.com/package/@forge/cli
Out of Scope (13)
Any internal or development services.
https://bugcrowd.com/atlassianapps
https://shop.atlassian.com
bytebucket.org
*.bitbucket.io
https://blog.bitbucket.org
HipChat
Stride
https://support.atlassian.com
Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of <customer>.atlassian.net or <customer>.jira.com. Test only your own instances.
Any repository that you are not an owner of - do not impact Atlassian customers in any way.
https://support.loom.com
https://info.loom.com/