Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 23 Sep 2026.

This bounty is part of the Atlassian Marketplace Bounty Program We are one of hundreds of vendors on the Atlassian Marketplace. However, what we try to do differently is to focus on the user experience and security. We want to make our apps easy and natural to use, and protect customers' data, so they can focus on what matters most, their business. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact HeroCoders or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Quick Links Portfolio by HeroCoders (Structure PPM for Jira & Capacity) Checklists for Jira (Enterprise) by HeroCoders Checklists for Jira (Pro) by HeroCoders (same codebase as Checklists for Jira (Enterprise) by HeroCoders) Checklists for Jira (Free) by HeroCoders (same codebase as Checklists for Jira (Enterprise) by HeroCoders) Acceptance Criteria for Jira (Free) (same codebase as Checklists for Jira (Enterprise) by HeroCoders) Clockwork Pro for Jira Time Tracking and Timesheets Clockwork Lite Time Tracker - Time Tracking and Timesheets (same codebase as Clockwork Pro for Jira Time Tracking and Timesheets) Important The free/lite products linked above share a codebase with their Pro/Enterprise sibling product. So, it is enough to test only Pro or Free. For example, if you work with Issue Checklist Pro, then you don't need to test Issue Checklist Free. We will treat the same submissions as duplicates across the two sibling targets. Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Ensure you review the out of scope and exclusions list for further details. ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.