Strengthening supply chain security together: Bugcrowd’s custom program for Atlassian Marketplace

The Bugcrowd Solution

After brainstorming, Atlassian and Bugcrowd aligned on a solution: quarterly bespoke methodology assessments. In this approach, Bugcrowd’s in-house team spent a day evaluating each app with zero reported vulnerabilities, using a jointly-defined methodology. The team repeated this process every quarter to catch new issues.

“This approach allowed us to focus on areas of highest risk and the flexibility to customize evaluation criteria over time. Bugcrowd performed the assessments and delivered findings in their characteristic collaborative way—while our partners benefited from the additional insights,” explained Vlad Yastreboff, Senior Manager, Security at Atlassian.

To execute this solution, Bugcrowd and Atlassian identified the partners and applications that needed to be tested, along with the methodology of test cases and triaging criteria. With this groundwork laid, Bugcrowd assembled a team of researchers to test each application. Results were reported to Atlassian in realtime via a shared tracker. Once the testing was completed, Bugcrowd delivered a comprehensive report of vulnerabilities across all applications.

Vlad said, “Bugcrowd hit the ground running and partnered with us throughout the process. We saw the first batch of vulnerabilities just a week after finalizing our approach. We reviewed the results in our biweekly catch-up and gave feedback, which they promptly incorporated. Before we knew it—nine weeks later—we had a full report across all our high-risk partner apps!”

The Outcomes

Over the ten weeks of testing, the bespoke assessments revealed 116 vulnerabilities across the Marketplace apps, of which 21% were crucial or high-severity. Atlassian immediately began working with each partner to investigate and fix the issues, strengthening customer trust in Atlassian’s Marketplace apps and ecosystem.

“The great thing about Bugcrowd’s ability to rapidly deliver a variety of distinct, but complementary, security assessment services, is that we can rapidly mix and match to achieve the right level of technical security assurance, while leveraging Bugcrowd’s proven service delivery model. It’s been a great experience,” Vlad said.

The success of this initiative underscores the benefits of partnering with security experts to tackle complex ecosystem challenges. “This bespoke solution showcases the power of Bugcrowd’s multi-solution crowd-sourced security platform,” Julian Brownlow Davies, VP of Advanced Services at Bugcrowd, explained. “By truly understanding Atlassian Marketplace’s unique situation and bringing our expertise, we delivered a solution that provided Atlassian customers and vendor partners the security assurance and coverage they needed.”