Found exposed Jira dashboards — worth reporting or will I lose points?

Question / Discussion

Hey folks,

I was poking around a target (something like target.atlassian.com) that I know is out of scope for their bug bounty. Still, when I accessed it I could see a Jira dashboard with filters and panels. I couldn’t open actual tickets or project details, but I could clearly see:

  • employee names
  • project names and identifiers
  • the dashboard layout and filters

I don’t want to risk getting my bounty points or eligibility reduced, but this feels worth flagging — there are a lot of employee names and projects listed, and to me that looks like sensitive info. Would you report this as something actionable, or would most programs treat it as low-impact since the ticket contents aren’t exposed?

What would you do if you were in my shoes?

Posted Oct 2, 2025, 1:45 PM UTC

04
Loading comments…