Security Policy for Attachment Text Editor for Jira
Last Updated: October 24, 2026
1. Introduction
This Security Policy outlines the measures that protect your data when you use Attachment Text Editor for Jira.
2. Forge Architecture
The App is built natively on the Atlassian Forge platform:
No data egress: the App does not communicate with any external server, CDN or third-party API. Its code is bundled and served by Atlassian.
Isolated runtime: the App runs in Atlassian's isolated, managed Forge environment.
3. Scoped Permissions
The App requests only the Atlassian API scopes it needs:
read:jira-work: to list and download the work item's attachments and check your attachment permissions.
write:jira-work: to save edited or new files as attachments and remove the version they replace.
4. Data Protection
Data in transit: all communication with Jira's APIs is encrypted with TLS.
Data at rest: any data the App keeps stays in your Atlassian site, protected by Atlassian's encryption standards.
Your permissions apply: every request runs as you; replacing a file requires Jira's attachment create and delete permissions, and the app offers read-only viewing otherwise.
Everything bundled: the code editor and all its components are served with the app, not loaded from a CDN.
Size limit: files over 5 MB are not opened in the browser.
5. Vulnerability Management
We welcome the responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to us at the email address below.