You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
We maintain an always-on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third party that shows that we are testing the security of our own products and services.
As part of our commitment to ensuring the highest level of security for our systems, we have expanded our efforts to include both penetration tests and our always-on bug bounty program. With over 1200+ security researchers actively contributing, our bug bounty program serves as an extension of our own team, providing continuous monitoring and testing for potential vulnerabilities. In addition, we have recently shared our insights on the nuances between penetration tests, vulnerability assessments, and bug bounty programs on our Approach to Security Testing page, which is publicly accessible on our external website. We believe that this comprehensive approach provides superior value compared to relying solely on a couple of people for a limited time period.
At the start of each quarter, we publish a roll-up report from each of our Bug Bounty programs to give our customers a view of the progress of the program and the vulnerabilities. For many customers, these reports can take the place of a penetration test report and shows that we are actively testing and identifying any security issues that are in our products or services.
Stats for the Quarter
In the January 2023 to March 2023 quarter, we had 250 individual security researchers contribute to our bug bounty program, submitting a total of 533 bugs for review, with a total of 123 valid bugs, which is an average of ~29.67% valid bug to noise ratio (with a low of 9% valid bug to noise ratio in our Halp program and a high of 100% valid bug to noise ratio in our Jira Align program) across our six independent bug bounty programs.
Compared to the October to December 2022 quarter, we had a 12% increase in security researchers, 6% more bugs submitted for review, and a 10% decrease in valid bugs, with a higher bug-to-noise ratio by ~7%.
Get the Reports
If you have customers asking for a penetration test report, point them out to the Approach to Security Testing page, where (down at the bottom) we have published reports for Atlassian (including Jira, Confluence, Bitbucket, and more), Halp, Jira Align, Opsgenie, Statuspage, and Trello. We have also published the same links to the Security Testing section of our Security Practices page.
Download current test reports
These reports show the progress of our bug bounties for the January 2023 to March 2023 quarter. Any security vulnerabilities identified in the reports below are tracked in our internal Jira as they come through the Bug Bounty intake process and are closed according to the SLA timelines on our Security Bug Fix Policy.