This app runs entirely inside Atlassian. It has no outbound network access, no server of ours,
and no database of ours. There is no infrastructure on our side for an attacker to reach, because
there is none at all — everything the app stores lives in Atlassian's own storage, inside your
site's region.
That shapes everything below. The realistic risk here is not a breached server; it is the app
showing someone data they should not see, or storing more than it needs.
Reporting a vulnerability
Write to support@avakode.com with “security” in the subject.
Please include what you found, how to reproduce it, and what an attacker could do with it. Send it
to us before publishing, and give us a chance to fix it.
We acknowledge every report within three business days.
We tell you our assessment — severity, whether we can reproduce it, and what we intend to do —
within ten business days.
A confirmed vulnerability takes priority over any feature work in progress.
We will credit you when we publish the fix, unless you would rather we did not.
We do not run a paid bug bounty and we do not hold a security certification such as SOC 2 or
ISO 27001. Saying otherwise would be easy and untrue.
If something goes wrong
An incident here means one of two things: the app exposed data to someone who should not have
seen it, or the app lost data it was holding.
We stop the cause first. A Forge app can be fixed and redeployed for every customer at once,
so containment does not wait for anyone to upgrade.
We notify affected customers by email at the address on the Marketplace account, describing
what happened, what data was involved and what we did about it — within 72 hours
of confirming an incident.
We report incidents involving our apps to Atlassian, as the Marketplace Partner Agreement
requires.
Afterwards we write down what let it happen and what changed so it cannot repeat. Our test
suite is where those lessons end up.
Access control
Everything the app reads from Jira, it reads as the person using it. Jira's own
permissions apply unchanged: the app cannot show anybody an issue they could not open themselves.
The app requests the narrowest set of scopes that make it work, and they are listed on the
installation screen before you approve them.
Configuration screens are limited to Jira administrators or project administrators, depending
on what is being configured.
Nobody at our end has access to your site or your data. We cannot read your issues, and we do
not have a support tool that would let us.
The Atlassian account that owns these apps is protected with two-step verification.
Data protection
Storage is Atlassian's Forge storage, inside Atlassian's infrastructure and your site's
region. Encryption at rest and in transit is provided by the platform.
There is no copy of your data anywhere else. No analytics, no telemetry, no third-party
processors, no backups of ours.
Of personal data the app keeps only Atlassian account IDs, plus a display name where the
product genuinely needs one. Where it does, we report those accounts to Atlassian weekly and
erase the name when an account is closed.
Uninstalling the app removes its storage. Before you do, export what you want to keep — every
app can write its contents to a file from its own screens.
Monitoring
Errors and invocation metrics are visible to us in the Atlassian developer console, and we
watch them.
Logs deliberately exclude your content. Issue summaries, worklog comments, invoice amounts
and scenario text are never written to a log — that rule is enforced in the code, not left to
discipline.
How the app is built
Every change runs an automated test suite before it ships. Tests cover the places where a
mistake would be silent: permission checks, money arithmetic, and what the app stores.
The app has no third-party runtime dependencies beyond Atlassian's own Forge packages. There
is no supply chain here to compromise.
No credentials, keys or tokens live in the app's source. The app has nothing to authenticate
to — it never leaves Atlassian.
Questions
If your security team needs something this page does not answer, write to
support@avakode.com. We would rather answer a questionnaire than
lose you to silence.