Security Policy

1. Reporting a vulnerability

[email protected]

It helps if you include:

• The app name and, if you know it, the version
• Steps to reproduce
• The likely impact (who could see or change what)

We acknowledge reports within two business days. English and Japanese are both fine.

2. When you investigate

• Test on an Atlassian site that you administer.
• Do not view, change or copy other customers' data.
• Do not run tests that flood the service with requests.

We will not take legal action against anyone who investigates and reports in good faith within these limits. We do not run a bug bounty.

3. Fix timelines

We rate severity with CVSS and release fixes within the timelines in Atlassian's Security Bug Fix Policy for Marketplace apps.

If a vulnerability or incident affects customer data, we notify the affected customers and Atlassian without undue delay once we know.

4. How the apps are built

• All apps run on Atlassian Forge. Their data is kept in Forge storage and does not leave Atlassian.
• The apps make no requests to servers outside Atlassian.
• Each app asks only for the permissions (scopes) its features need. The permissions and stored data for each app are listed on its page and in the Privacy Policy.
• We check dependencies for known vulnerabilities and fix what we find.

5. Contact

For anything other than security, please use Support.