Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 4 Oct 2026.

This bounty is part of the Atlassian Marketplace Bounty Program 55 Degrees helps companies get more done with less stress. We do this by offering training and consultancy within the Lean and Agile space. In addition, we build apps that help our customers get their jobs done. Only test ActionableAgile for Jira. No other versions of ActionableAgile are in scope or part of this program. Get Started (tl;dr version) Do not access, impact, destroy or otherwise negatively impact 55 Degrees or Atlassian customers, or customer data in any way. Ensure that you use your @bugcrowdninja.com email address. Ensure you understand the targets, scopes, exclusions, and rules below. Quick Links ActionableAgile for Jira Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access** Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues ** Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Ensure you review the out of scope and exclusions list for further details. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.