Atlassian interviews

“We have an internal penetration testing team that takes a risk-based approach to perform white-box (code & engineer assisted) security assessments on areas of the business (whether this be in our cloud environments, new products or features, or internal systems and tooling).”

“Vulnerabilities in third party code that are unreachable from Atlassian code may be downgraded to low severity.”

“For example, a mitigating factor could be if your installation is not accessible from the Internet.”

“In some cases, Atlassian may use additional factors unrelated to CVSS score to determine the severity level of a vulnerability.”