BC Bugcrowd LIVE
Atlassian
up to$12,000
Open on Bugcrowd ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- managed triage
- yes
- safe harbor
- full
48 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
GraphQL API (bugbounty-test-<bugcrowd-name>.atlassian.net/gateway/api/graphql) | api | · | · | 2026-09-20 |
https://admin.atlassian.com/ | domain | · | · | 2026-09-20 |
https://admin.atlassian.com/atlassian-guard | domain | · | · | 2026-09-20 |
https://bitbucket.org | domain | · | · | 2026-09-20 |
https://id.atlassian.com/login | domain | · | · | 2026-09-20 |
https://marketplace.atlassian.com | domain | · | · | 2026-09-20 |
https://start.atlassian.com | domain | · | · | 2026-09-20 |
https://www.atlassian.com/enterprise/data-center/bitbucket | domain | · | · | 2026-09-20 |
https://www.atlassian.com/enterprise/data-center/crowd | domain | · | · | 2026-09-20 |
https://www.atlassian.com/enterprise/data-center/jira | domain | · | · | 2026-09-20 |
https://www.atlassian.com/enterprise/data-center/jira/service-management | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/atlas | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/bamboo | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/compass | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/confluence | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/confluence/premium | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/crucible | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/fisheye | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/jira | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/jira/product-discovery | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/jira/service-management | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/jira/work-management | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/rovo | domain | · | · | 2026-09-20 |
https://www.atlassian.com/software/rovo-dev | domain | · | · | 2026-09-20 |
https://www.loom.com/ | domain | · | · | 2026-09-20 |
https://www.loom.com/download | domain | · | · | 2026-09-20 |
https://apps.apple.com/us/app/confluence-cloud/id1006971684 | mobile | · | · | 2026-09-20 |
https://apps.apple.com/us/app/confluence-server/id1288365159 | mobile | · | · | 2026-09-20 |
https://apps.apple.com/us/app/jira-cloud-by-atlassian/id1006972087 | mobile | · | · | 2026-09-20 |
https://apps.apple.com/us/app/jira-server/id1405353949 | mobile | · | · | 2026-09-20 |
https://apps.apple.com/us/app/loom-screen-recorder/id1474480829 | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.atlassian.android.confluence.core&hl=en_US&gl=US | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&hl=en_US&gl=US | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.atlassian.confluence.server | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.atlassian.jira.server&hl=en_US&gl=US | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=com.loom.android&hl=en_US&pli=1 | mobile | · | · | 2026-09-20 |
Any associated *.atlassian.com or *.atl-paas.net domain that can be exploited DIRECTLY from the *.atlassian.net instance | other | · | · | 2026-09-20 |
Forge Platform | other | · | · | 2026-09-20 |
Other - (all other Atlassian targets) | other | · | · | 2026-09-20 |
https://chromewebstore.google.com/detail/loom-%E2%80%93-screen-recorder-sc/liecbddmkiiihnedobmlmillhodjkdmb?hl=en-US&pli=1 | other | · | · | 2026-09-20 |
https://confluence.atlassian.com/doc/install-atlassian-companion-992678880.html | other | · | · | 2026-09-20 |
https://mcp.atlassian.com | other | · | · | 2026-09-20 |
https://support.atlassian.com/rovo/docs/use-rovo-dev-cli/ | other | · | · | 2026-09-20 |
https://www.atlassian.com/enterprise/data-center/confluence | other | · | · | 2026-09-20 |
https://www.npmjs.com/package/@forge/cli | other | · | · | 2026-09-20 |
https://www.sourcetreeapp.com/ | other | · | · | 2026-09-20 |
Any other *.atlassian.com or *.atl-paas.net domain that cannot be exploited directly from a *.atlassian.net instance | wildcard | · | · | 2026-09-20 |
https://*.atlastunnel.com | wildcard | · | · | 2026-09-20 |
13 out of scope — black ICE, don't touch
Any customer instance. Do not test customer instances or affect customer data. Customer cloud instances may be in the form of <customer>.atlassian.net or <customer>.jira.com. Test only your own instances.domainAny internal or development services.domainAny repository that you are not an owner of - do not impact Atlassian customers in any way.domainbytebucket.orgdomainhttps://blog.bitbucket.orgdomainhttps://bugcrowd.com/atlassianappsdomainhttps://info.loom.com/domainhttps://shop.atlassian.comdomainhttps://support.atlassian.comdomainhttps://support.loom.comdomainHipChat (inc. HipChat Data Center, HipChat Desktop, HipChat Mobile)otherStride (inc. Stride Video, Stride Desktop, Stride Mobile)other*.bitbucket.iowildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.