Bug bounty
annual report
July 2022 - June 2023

Table of contents
1Introduction

2

Notable developments

2		

Expanded scope of report2		

Updated data tracking

3		

Expansion of Atlassian’s security testing capability

3		

Increased bounty payments in FY24

4

Bug bounty results for our last fiscal year4		

Scope of report5		Vulnerability reports by CVSS severity level

6		

Vulnerability reports by type7		Bounty payments by CVSS severity level

8		

Bounty payments by vulnerability type9		Time to resolve reported vulnerabilities by CVSS severity level

10		

Vulnerability reports by product11		

Bounty payments by productThis report summarizes the results for Atlassian’s bug
bounty program for Atlassian’s financial year — July 1, 2022
through to June 30, 2023 (FY23). This includes a look at theresults of the program across a range of metrics that are
product, vulnerability, and payment based. Since we began
our bug bounty program in 2017, it has been a fundamental
cornerstone of our security assurance process fordiscovering and addressing vulnerabilities in our products.

BUG BOUNTY ANNUAL REPORT1

Notable developments
Expanded scope of report
This year we have expanded the scope of this report to include three more of
our products:· Atlas· Bamboo· Compass

Updated data tracking
Utilising the connection between the data provided from our bug bounty andour internal vulnerability management dashboards, we were able to produce
a dashboard that provides a level of granularity that was not available forprevious reports.
All reports submitted through our bug bounty program undergo an
additional level of verification and triage by our engineers, who have a deep
understanding of our infrastructure and environment, before being included in
our internal vulnerability management dashboards.
This increased scrutiny of the data and underlying root cause of vulnerabilities
has resulted in lower overall numbers (for reference, FY23 has a 30% decrease
from FY22 in the total number of reports). However, has created moreactionable and auditable data as we are now only reporting on the reportsthat have been triaged into our internal vulnerability management dashboard(this includes reports that had both a payout and no payout).
Please refer to Atlassian Vulnerability Management for more information on
how we track vulnerabilities internally.

BUG BOUNTY ANNUAL REPORT

2

Expansion of Atlassian’s security testing capability
Security testing efforts at Atlassian have seen a significant increase over thepast year. The Security Testing team is working closely with cyber security
consultancies to conduct thorough penetration tests on Atlassian products.
This approach ensures that Atlassian’s products and services undergo
rigorous testing and evaluation. By combining the bug bounty program withthe efforts by our security testing team, Atlassian can leverage the expertiseof external researchers while also maintaining a proactive and comprehensivesecurity posture.
This expansion in Security Testing has proven to be highly effective forAtlassian. The program’s success is likely one of the factors contributing to theobserved 30% decrease in bug bounty submissions during this financial year.
You can read more about these efforts at Approach to External Security
Testing where additionally we publish “Letters of Assessment” for the annual
penetration tests performed on Atlassian products.

Increased bounty payments in FY24
Atlassian is committed to enhancing and expanding our technical security
assurance programs. This includes implementing more focused Bug Bounty
programs and incentivising security researchers to concentrate on higher-riskareas in our products. As an example, from November to December 2023, weoffered a 5x rewards multiplier for critical vulnerabilities (CVSS score 9.0+) for
Confluence DC, which led to an increase in submissions and resulted in a moresecure product.

BUG BOUNTY ANNUAL REPORT3Bug bounty resultsfor our last fiscal year
Scope of report
Below we go into more detail around the results from our bug bounty program
for the last financial year. The scope of the data we’ve included is focused onthe following Atlassian products:
AtlasHalpOpsgenie

BambooJira Align

Statuspage

Bitbucket

Jira Software

TrelloCompass

Jira Service Management

Automation for JiraConfluence

Jira Work Management

Ecosystem
IdentityIn the July 2022 - June 2023 time-frame, Atlassian received a total of 251 valid
vulnerability reports via our bug bounty program (from 79 unique researchers)
which resulted in a payment for the products listed above. In the preceding year,
Atlassian received a total of 358 valid vulnerability reports, which represents a30% decrease year-over-year. Roughly 23% of the reports received were paid out,
with roughly 77% of reports being unpaid reports.1
The remainder of this paper focuses on the data around these vulnerability reports.
We also saw an overall decrease in total vulnerabilities reports across all ourbug bounties by 36% year–over-year, from 3,266 in FY22 to 2,076 in FY23.
Any security vulnerabilities identified from our bug bounty program are tracked
in our internal Jira as they come through the intake process and will be triaged
and remediated according to our Security Bug Fix Policy.
1. A reported vulnerability may not result in a payment for a range of reasons, including it not being
reproducible by Atlassian, outside the scope of the program, a duplicate of a vulnerability alreadyreported, or real but not entitled to a bounty payment (for example, because the bug is real but gives noadvantage to a potential attacker).

BUG BOUNTY ANNUAL REPORT

4

Vulnerability reports by CVSS severity level
The following graph displays the count of valid low, medium, high, and criticalvulnerabilities that were reported to Atlassian through the bug bounty
program for the products in-scope.

60%of reports wereclassified as Medium

VULNERABILITY REPORTS BY CVSS SEVERITY LEVEL

4P1 (critical)

P2 (high)

34
150

P3 (medium)P4 (low)60

3P5 (informational)
We can confirm that all four critical findings
have been remediated in accordance with
our Security Bug Fix Policy SLOs (which statethat critical severity bugs should be fixed in theproduct within 14 days of being verified).
60% of reports received related to vulnerabilities wereclassified by Atlassian as Medium (P3) according to theCommon Vulnerability Scoring System (CVSS) and ~84%of all vulnerabilities were Medium (P3) or Low (P4).

BUG BOUNTY ANNUAL REPORT

5

Vulnerability reports by typeThe graph below outlines the types of vulnerabilities that were mostfrequently reported to Atlassian. Insecure Direct Object References (IDOR)
related issues were the most frequently reported type of vulnerabilities, with50 reports. Broken Authentication and Session Management (BASM) followed
closely behind with 49 reports. These two categories combined accounted for
39.4% of the total reported vulnerabilities in the bug bounty program.
We have also updated our visualisation this year to provide our customers witha more in-depth view of the priority level at which our bug types usually fall.

5049

38
221616117732110
P1 (critical)

10
P2 (high)

20

30

Number of reports by priority
P3 (medium)P4 (low)

4050

P5 (informational)

In FY22, we received 138 valid BASM vulnerabilities, and in FY23, we received
49 valid BASM vulnerabilities, representing a decrease of 64%.

BUG BOUNTY ANNUAL REPORT

6Bounty payments by CVSS severity level
In our last financial year, Atlassian made a total of $251,883 (USD) worth ofpayments via its bug bounty program for the products in-scope for this paper.
The highest cumulative payments were for vulnerabilities that fell into themedium (P3) severity level, at $128,400, and high (P2) severity level, at $74,100.
In our preceding year, Atlassian made a total of $383,600 worth of payments,
which represents a ~34% decrease in payments for the FY23 financial year
(this decrease in payments comes as a direct result of the decrease in thenumber of reports).
It is important to note that the amount of payment for individual bugs willvary based not only on the CVSS severity level, but also which product thereport applies to (critical reports for our Tier 1 products for example will pay
higher than a critical report for a Tier 2 or Tier 3 product). Average payout per
severity is noted in parenthesis.

Atlassian made $251,883
worth of total payments
via its bug bounty program
TOTAL PAYMENTS BY CVSS SEVERITY LEVEL ($USD)$26,833

P1 (critical) - ($6,708)
P2 (high) - ($2,179)

P3 (medium) - ($856)$74,100$128,400$18,600

P4 (low) - ($310)$3,950P5 (informational) - ($1,317*)*Informational reports that had a pay-out came as a result of reports that were initially categorised in ahigher category and paid out, which were then recategorised to Informational upon further review. There istypically no pay-out for reports that are initially categorised as Informational.

BUG BOUNTY ANNUAL REPORT

7Bounty payments by vulnerability typeIn the graph below we break down the total bounty payments Atlassian madefor each vulnerability type, taking into account CVSS severity level and producttier. It is important to note that in some instances, the higher CVSS level ofreported vulnerabilities resulted in a higher total payout to researchers forparticular categories, even when those categories may have had less totalreports for the financial year than others.

$48,500$39,100$35,400$33,700$30,000$21,200$17,400$8,350$7,100$6,833$2,400$1,400$300$200

BUG BOUNTY ANNUAL REPORT8

Time to resolve reported vulnerabilities by CVSS severity levelThe graph and data below indicates the median time, in days, Atlassian took toresolve vulnerabilities reported to it via the bug bounty program.

MEDIAN TIME TO RESOLVE VULNERABILITIES (DAYS)P1 (critical)

P2 (high)

3.5

100%
14.1

82%
30.1

P3 (medium)

92%
62.7

P4 (low)

MEDIAN TIME TO RESOLVEVULNERABILITIES (DAYS)91%

PERCENTAGE OF VULNERABILITIESMET WITHIN SLO TIMEFRAME

As a point of comparison, Atlassian’s SLOs for different vulnerability types (asper our Security Bug Fix Policy) are listed below:· Critical severity bugs to be fixed in product within two weeks ofbeing verified· High severity bugs to be fixed in product within four weeks ofbeing verified· Medium severity bugs to be fixed in product within six weeks ofbeing verified· Low severity bugs to be fixed in product within 25 weeks of being verified
For all vulnerability severities, the median time to resolve vulnerabilities wereless than the current SLO.

BUG BOUNTY ANNUAL REPORT

9Vulnerability reports by productThis graph covers the number of valid vulnerabilities reported for each productduring the July 2022 — June 2023 (FY23) period for which a payment was made.
Confluence Cloud had the largest number of reported vulnerabilities for whichpayments were made (49), followed by Trello (44), Jira Software (27) and JiraAlign (24). Jira Work Management had the least number of valid vulnerability
reports at zero.
We have also updated our visualisation this year to provide our customers
with a more in-depth view of the priority level at which our bug types usually
fall for each product.

494427242118131111108552201020304050

Number of reports by priorityP1 (critical)

BUG BOUNTY ANNUAL REPORT

P2 (high)

P3 (medium)P4 (low)

P5 (informational)

10

Bounty payments by productIn the graph below, we break down the total bounty payments made by
product. Confluence Cloud had the highest cumulative payout ($92,600),
followed by Jira Software ($40,150), Trello ($30,733) and Opsgenie ($23,100).

$92,600$40,150$30,733$23,100$23,000$21,900$21,400$11,200$8,900$8,600$8,400$4,700$3,200$3,200$2,400BUG BOUNTY ANNUAL REPORT

11

More information
If you need more information about Atlassian’s
bug bounty program, approach to security testing,or security program more generally, you can checkout the following resources:· Our Approach to External Security Testing· Our Security Bug Fix Policy· The Atlassian Trust Center

You can also contact Atlassian’s Trust Team, via our support portal
if you still need further clarification on anything to do with this paperor our approach to security generally. Alternatively, ask a questionin our Atlassian Trust and Security Community.

©2024 Atlassian. All Rights Reserved. CSD-9226_DRD-1/24