Although we are just customers of Atlassian using Jira/JSM products and not application development vendors, third party vendor's participation in the Bug Bounty program with Atlassian is one thing that we will always look for. If a third party vendor are not an participate of the program, then we will not even consider their add-ons at all.
Take a look at the following Atlassian reference links on this program -
Although I do not know what your app is about, I'd recommend re-checking on proper authentication and remediation of everything related to user inputs and XSS to have a smooth start.
We are in the program and make sure that all of our apps (4 so far) attain Cloud Fortified status. The Marketplace is getting increasingly noisy and competitive so having these clear, third party validators for our apps definitely assists in our perception.
As we (Revyz) are in the enterprise space as well as being a data protection and security vendor - its a no-brainer for us to be in bug bounty. A couple of other areas that we have decided to sign up to are multi-residency for client data and SOC2 - we have prospective customers asking about both fairly frequently.
Our philosophy is to be as transparent and thorough as possible with our clients when it comes to security and compliance so we also publish the details on the security section of our support site.
