Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 20 Sep 2026.

This bounty is part of the Atlassian Marketplace Bounty Program Elements helps teams at more than 3500 companies be more productive with Jira and Confluence. A veteran of the Atlassian ecosystem, with nearly a decade of experience developing apps for Jira and Confluence, Elements is a Platinum Top Vendor of the Atlassian Marketplace. The Elements suite Connect (formerly nFeed), Copy & Sync, Checklist and Spreadsheet help companies transform old, manual ways of working into modern, streamlined workflows based on Jira and Confluence. Customers including Airbus, Apple, BBC, NASA, Nike, Oracle, Disney, BMW and Walmart trust Elements to help their teams work smarter. Elements is part of the Valiantys Group, a top Atlassian Platinum Solution Partner. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact Elements or Atlassian's customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Please note that the applications listed in the target are in scope. The URL itself is NOT. Quick Links Elements Connect - external data fields Elements Connect - helper app Elements Copy & Sync - Jira issue sync Elements Spreadsheet for Confluence Elements Publish to Confluence - create pages from Jira Elements Publish to Confluence - Jira helper app Elements Overview Elements Pulse Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please see below for deviations.