Bypass to get Trello Gold free for one year with $0
A security researcher who likes finding bugs as a hobby.
Trello is one of the best project management tools that I have had the chance on working on. And this is the story of how you are able to bypass the normal payment system and getting a paid Trello Gold account free for one year.
When I saw one of the best pm tools on the market having a bug bounty programme, that got me hooked. I already loved using trello and would have even more fun checking the features that I haven’t even tried before.
The first things that I tried were the very basic features. And understanding how, all the different objects are interrelated. Simply put, boards are made up of lists, these lists are like headers for your projects. Now under each list you have Cards. And on each card, you can create comments, attachments,etc …
After getting familiarized with the basic features, I decided to buy a gold account, which was $5. To test the billing feature, I fired up burp suite. The way trello works is that it keeps ‘refreshing’ the page and thus is able to give information in real-time.
Trello hates slow connections, and as I was analysing the requests I noticed that trello would timeout a lot of times and some debug messages would be shown as well. As I kept dropping connection, one of my billing requests went through without being dropped.
Gold accounts activated !
I knew that the credit card was unprovisionned and in no way I paid for the account. How could I get trello gold??
Well, unlike most services, that require payment “before” activating premium features, Trello actually allows users to get Gold accounts before the bill is paid.
To explain that more clearly, lets consider the normal payment flow on another website like Dropbox.
Normal flow – Dropbox
Dropbox gives you free accounts with limited storage space – 2GB.
Now, if you want to get a Dropbox Plus account featuring 1TB of storage space, you would need to pay $99.
The way this payment works is.
- Click on upgrade account
- Enter your credit card details
- Payment part (This is the key part)
Card has money, you are charged $99 and upgraded to Dropbox Plus account
Card is declined (as it is unprovisionned), you stay on your free dropbox account and you get an error message.
- Same as before
- Same as before
- Payment Part
If your card has money on it, you are charged $45 -1 year . and you get a Gold account with all premium features.
If your card has no money, you are charged $0 – 1 year. And you still get a Gold account with all premium features.
Trello Business Account
Trello has another account class called : Trello Business Class which is for enterprise and using an unprovisioned card, you are still able to acquire the account which normally costs $128 per member.
During the tests, I was able to add 2 members to business class for a total of $256. This can be done for as many members as you need.
But there’s still an invoice pending?
Yes, you get a message for a pending invoice, but you are can transfer all your data and sync them to another account. Then, delete your account permanently.
Sign up first for a Trello account.
Use a unprovisionned/declined credit card.
Cancel your premium account.
You can still use the premium features for free.
Alternative ways would be to get an online credit card number. Sign up for an anonymous email address and use all premium features free of charge.
Remember: It doesn’t have to be provisionned.
After sending a bug report as part of responsible disclosure. Trello acknowledged the report and considers this ‘a feature’.
As they explained to me, it doesn’t affect the security or data of their users.
They thus accepted to disclose this report publicly and allowed me to blog about it.
Explanation from Trello:
I wish to thank Danlec from Trello and the Hackerone team for this wonderful experience. And I’ll be on the lookout for more bugs on Trello 🙂
The premium test accounts on trello have been cancelled.
I encourage anyone to buy a premium Trello account rightfully. Like I said Trello is the best project management out there. If you need the premium features buy it ! 🙂