When you connect Atlassian, Hai reviews related Jira issues and Confluence pages before making decisions about a report. This includes remediation runbooks, architecture notes, and accepted-risk decisions, helping Hai account for information your team has already documented.
What Hai Does with Your Atlassian Workspace
Searches Jira and Confluence with read-only access for information, such as:
Related or previously reported Jira issues on the same asset or component
Documented mitigations, compensating controls, or accepted-risk decisions
Evidence that the reported behavior is by design
Evidence that the affected asset is deprecated, sunset, or non-production
Confluence runbooks, remediation guides, and architecture docs for the affected system
Hai uses this information in two ways:
Hai conversations — ask Hai for related tickets and documentation while you review a report, and it answers from your workspace instead of guessing.
Validation reasoning — before Hai recommends an outcome, it searches Jira and Confluence and cites what it found in its reasoning.
In both cases, Hai is strictly read-only: it can read issues and pages but cannot create, edit, transition, or comment on anything. Jira write capabilities require separate, optional configuration, and Hai can never modify Confluence at all.
See It in Action
When Hai searches your Atlassian workspace while validating a report, the search appears in the reasoning stream, and you can expand the step to see what Hai found and how it used that information.
The report's outcome summary then shows Atlassian as one of the sources behind the recommendation, next to the validation status and any other evidence Hai gathered.
Example: Using Confluence Context in a Remediation Recommendation
A researcher reports a SQL injection (CWE-89) against the payments service.
Hai searches Confluence, starting specific and broadening if it finds nothing: first the CWE plus the affected asset (CWE-89 payments.example.com), then the CWE alone (CWE-89), then the vulnerability class (SQL Injection remediation).
It finds the Payments data access standards page, which mandates parameterized queries through a shared data-access layer, plus the on-call runbook for that service. In Jira it finds SEC-1043, a related injection issue on the same service fixed last quarter.
Hai uses the documented standard to inform its remediation recommendation and identifies the responsible team from the runbook. The reviewer can also see that a similar issue was previously reported and resolved.
If you also enable Jira issue creation, Hai goes one step further: after creating the issue, it searches Confluence for the relevant runbooks and posts them as a comment on the new ticket, so the engineer who picks it up starts with your documentation already attached.
Before You Begin
Atlassian must be enabled for your organization. Contact your HackerOne representative if the integration does not appear in your settings.
Your Atlassian administrator must enable API token access for Atlassian Rovo MCP.
An Atlassian account with access to the Jira and Confluence workspaces you want to connect.
Organization admin access in HackerOne.
Create an Atlassian API Token
Open the Atlassian API token page.
Select Rovo MCP.
Select the Jira and Confluence scopes you want the integration to have access to.
Enter a name for the token.
Click Create.
⚠️ Copy the token. Atlassian only displays it once.
Step 1: Connect Your Workspace
In HackerOne, go to Organization settings → Integrations.
Under Hai integrations, click Connect next to Atlassian.
Enter the workspace name, the email address used to create your API token, and the token itself.
Click Connect.
Select the cloud space to connect.
Choose whether Hai can access Jira, Confluence, or both.
Click Next.
If you enable only one product, Hai scopes its searches accordingly: with Confluence off it searches Jira only, and with Jira off it searches Confluence only. You can also set a Confluence space so documentation searches are scoped to it.
Step 2: Enable Contextual Enrichment
Go to Organization settings → Integrations → Atlassian → Global features:
Toggle | What it does |
Hai integration | "Let Hai pull in Atlassian context when investigating reports — duplicates, related work, and more." |
Validation agent | "Automatically pulls context from your Atlassian workspace to enrich validation reasoning on reports." |
Both toggles grant read-only access only. Neither lets Hai write to Jira.
Optional: Jira Issue Creation
Everything from here down is optional and added for convenience in case you would like to automatically trigger the creation of new Jira issues. Don’t follow these steps and the contextual enrichment above still works.
Map Jira Projects
Map each HackerOne program to a Jira project. If you don't create a mapping, Hai automatically selects the Jira project it determines is the best match when creating an issue.
Click Next.
Configure Automatic Issue Creation
Enable Automatic issue creation.
Select the report state that should trigger issue creation.
Click Next.
Before creating an issue, Hai checks the Jira project's available issue types and required fields.
Optional: De-duplication
Choose whether Hai should check for an existing Jira issue before creating a new one. When de-duplication is enabled, Hai searches for matching Jira issues before creating a new one. If it finds a strong match, Hai links the existing issue to the HackerOne report instead of creating a duplicate. The default confidence threshold is 75%.
Click Finish.
Your Atlassian workspace is now connected.
Optional: Report Updates Posted to Jira
When a linked HackerOne report changes, such as when its state or severity changes, Hai can post a summary comment on the corresponding Jira issue.
Updates flow in one direction: from HackerOne to Jira. Changes made in Jira are not reflected in the HackerOne report. You can also explicitly ask Hai to edit or transition a Jira issue during a conversation. Hai does not perform these actions automatically.
Hai cannot delete Jira issues or modify Confluence pages.
FAQ
Does Hai change anything in Jira just because I connected it? No. Connecting the workspace enables read-only context. Issue creation and update comments are separate, opt-in settings.
Can I connect Confluence without Jira? Yes. Choose Confluence only during setup and Hai uses documentation context without touching Jira.
Is my Atlassian data copied into HackerOne? No. Hai queries Jira and Confluence on demand for a specific report and uses what it finds in that investigation.
Why doesn't Hai find our documentation? Confluence search matches on CWE identifiers, asset names, and vulnerability types. If your pages use non-standard naming for these, Hai may not surface them — naming the CWE or asset in the page title and body helps. Scoping the integration to the right Confluence space also improves results.