Bypass to get Trello Gold free for one year with $0

Bypass to get Trello Gold free for one year with $0

free trello gold
Who am I ?

A security researcher who likes finding bugs as a hobby.

Trello

Trello is one of the best project management tools that I have had the chance on working on. And this is the story of how you are able to bypass the normal payment system and getting a paid Trello Gold account free for one year.

Having fun!

When I saw one of the best pm tools on the market having a bug bounty programme, that got me hooked. I already loved using trello and would have even more fun checking the features that I haven’t even tried before.

The first things that I tried were the very basic features. And understanding how, all the different objects are interrelated. Simply put, boards are made up of lists, these lists are like headers for your projects. Now under each list you have Cards. And on each card, you can create comments, attachments,etc …

After getting familiarized with the basic features, I decided to buy a gold account, which was $5. To test the billing feature, I fired up burp suite. The way trello works is that it keeps ‘refreshing’ the page and thus is able to give information in real-time.

Slow connections

Trello hates slow connections, and as I was analysing the requests I noticed that trello would timeout a lot of times and some debug messages would be shown as well. As I kept dropping connection, one of my billing requests went through without being dropped.

Gold accounts activated !

free trello gold

I knew that the credit card was unprovisionned and in no way I paid for the account. How could I get trello gold??

Well, unlike most services, that require payment “before” activating premium features, Trello actually allows users to get Gold accounts before the bill is paid.

Wait…What??

To explain that more clearly, lets consider the normal payment flow on another website like Dropbox.

Normal flow – Dropbox

Dropbox gives you free accounts with limited storage space – 2GB.

Now, if you want to get a Dropbox Plus account featuring 1TB of storage space, you would need to pay $99.

The way this payment works is.

  1. Click on upgrade account
  2. Enter your credit card details
  3. Payment part (This is the key part)

Card has money, you are charged $99 and upgraded to Dropbox Plus account

Card is declined (as it is unprovisionned), you stay on your free dropbox account and you get an error message.

Trello flow:

  1. Same as before
  2. Same as before
  3. Payment Part

If your card has money on it, you are charged $45 -1 year . and you get a Gold account with all premium features.

If your card has no money,  you are charged $0 – 1 year. And you still get a Gold account with all premium features.

trello gold account free

 

Trello Business Account

Trello has another account class called : Trello Business Class which is for enterprise and using an unprovisioned card, you are still able to acquire the account which normally costs $128 per member.

During the tests, I was able to add 2 members to business class for a total of $256. This can be done for as many members as you need.

But there’s still an invoice pending?

Yes, you get a message for a pending invoice, but you are can transfer all your data and sync them to another account. Then, delete  your account permanently.

Feature Abuse

trello gold

Sign up first for a Trello account.

Use a unprovisionned/declined credit card.

Cancel your premium account.

You can still use the premium features for free.

Alternative ways would be to get an online credit card number. Sign up for an anonymous email address and use all premium features free of charge.

Remember: It doesn’t have to be provisionned.

Bug Report

After sending a bug report as part of responsible disclosure. Trello acknowledged the report and considers this ‘a feature’.

As they explained to me, it doesn’t affect the security or data of their users.

They thus accepted to disclose this report publicly and allowed me to blog about it.

Explanation from Trello:

 

Thanks

I wish to thank Danlec from Trello and the Hackerone team for this wonderful experience. And I’ll be on the lookout for more bugs on Trello 🙂

Link to original report on hackerone

FYI

The premium test accounts on trello have been cancelled.

I encourage anyone to buy a premium Trello account rightfully. Like I said  Trello is the best project management out there. If you need the premium features buy it ! 🙂

Facebook Comments