How do I report a malicious repository?

[bennyn]

I was contacted by someone posing as a recruiter on LinkedIn with a well-paid job offer. They asked me to complete a take-home task linked in a Google Doc, which references a Bitbucket repository containing malicious code that performs remote code execution. How can I report the malicious repository (https://bitbucket.org/top-hvd-2025/hvd-bard-2026)?

[Mikael Sandberg · Accepted solution]

Hi @bennyn,

Welcome to Atlassian Community!

Send an email to abuse@atlassian.com with the information and that team will deal with it. Please note that you will not get a response back, but they will investigate. 

[Syahrul · Accepted solution]

Hey @bennyn 

Welcome to the community.

This has been action. Thank you for reporting this to us. Moving forward, feel free to report it directly to abuse@atlassian.com for quicker resolution.

Regards,
Syahrul

[Andrew Phillips]

Report it directly to Atlassian (Bitbucket)

Open repo → Report/Flag repository → choose malware/phishing

Or submit via Atlassian support with:

Repo URL

Screenshots

LinkedIn + Google Doc links

Also report the LinkedIn recruiter as scam/phishing and block them.