Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 20 Sep 2026.

This bounty is part of the Atlassian Marketplace Bounty Program DevSamurai is Atlassian solution and marketplace partner, we resell Atlassian products and build plugins. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact DevSamurai or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Please note that the application listed in the target is in scope. The URL (the Marketplace page) itself is NOT. Quick Links Agile User Story Mapping Board for Jira Note: If the same vulnerability exists in different hosting solutions of a single app, we may pay for this vulnerability once if the codebase and the fix is the same. We reserve the right to make this decision on a case by case basis. Additionally, there are apps that have distinct listings but share the same codebase. In such case we will only pay once across these apps, unless an environmentally unique vulnerability is discovered. Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: We prioritize the issue based on the following factors Business impact: depend on the feature itself and security issue we will treat it properly Our development plan: small business impact issues will be treated as low priorities with proper due date so that they won't affect our current plan.