Bug bounty program

Atlassian

Open on Bugcrowd Atlas

Platform: Bugcrowd
Bounties: Pays
Assets in scope: 50
Disclosed reports: 0
Subdomains: 77,384
Vendor on CyberSIXT: Atlassian (473 CVEs, 14 exploited)

Most upvoted reports0

No report of this program is publicly disclosed

In scope

Web applications29 assetshttps://admin.atlassian.com/atlassian-guard · https://admin.atlassian.com/ · https://id.atlassian.com/login · https://start.atlassian.com · https://bitbucket.org · https://www.atlassian.com/software/confluence · https://www.atlassian.com/software/confluence/premium · https://www.atlassian.com/software/jira/service-management
Mobile apps10 assetshttps://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US · https://apps.apple.com/us/app/confluence-cloud/id1006971684 · https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US · https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087 · https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1 · https://apps.apple.com/us/app/loom-screen-recorder/id1474480829 · https://play.google.com/store/apps/details?id=com.atlassian.confluence.server · https://apps.apple.com/us/app/confluence-server/id1288365159
Other assets10 assetsAny associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance · https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/ · https://mcp.atlassian.com · https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pl… · https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html · https://www.atlassian.com/enterprise/data-center/confluence · https://www.sourcetreeapp.com/ · Other - (all other Atlassian targets)
APIs1 assetGraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql)

Subdomains77,384

Root

Scope

Name suggests:Source code

First seen

Text fileClear filters23 names

Subdomains of Atlassian
Name	Scope	First seen
bitbucket.atlassian.comgit	In scope	2026-11-14
bitbucket-marketing-cdn.atlassian.comgit	In scope	2026-11-14
github.atlassian.comgit	In scope	2026-11-14
github.prod.inf.atlassian.comgit	In scope	2026-11-14
bitbucket-bamboo.internal.atlassian.comci, git, internal	In scope	2026-11-14
bitbucket-status-atlassia-e3ba1c5d-eaab-44c7-ac82-4a69aa51489d.saas.atlassian.comgit, monitoring	In scope	2026-11-14
support-or-operating-repo-9438e55c-a84e-459e-a47d-7294be166f1a.saas.atlassian.comgit	In scope	2026-11-14
compass-bitbucket-connect.services.atlassian.comgit	In scope	2026-11-14
bitbucket.status.atlassian.comgit, monitoring	In scope	2026-11-14
svn.atlassian.comgit	In scope	2026-11-14
bitbucket.atlassian.netgit	In scope	2026-11-14
git.atlassian.netgit	In scope	2026-11-14
git-scm.atlassian.netgit	In scope	2026-11-14
gitlab.atlassian.netgit	In scope	2026-11-14
gitlab-jira.atlassian.netgit, tools	In scope	2026-11-14
integra-scm.atlassian.netgit	In scope	2026-11-14
jummp-repo.atlassian.netgit	In scope	2026-11-14
repo.atlassian.netgit	In scope	2026-11-14
repos.atlassian.netgit	In scope	2026-11-14
scm.atlassian.netgit	In scope	2026-11-14
svn.atlassian.netgit	In scope	2026-11-14
www.svn.atlassian.netgit	In scope	2026-11-14
svn2.atlassian.netgit	In scope	2026-11-14

77,382 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.