Security Policy for Quick Notes

Last Updated: April 5, 2025

1. Introduction

This Security Policy outlines the security measures and practices that Victor Torres ("we", "us", or "our") implements to protect the data and infrastructure of our application, Quick Notes, on the Atlassian platform.

We are committed to maintaining the highest standards of security to protect our customers and their data. If you have any security-related questions or concerns, please contact us using the information provided at the end of this document.

2. Application Architecture

The Quick Notes app is built and deployed using the Atlassian Forge platform. This architecture provides a secure, sandboxed environment (running on modern Node.js environments) with the following inherent security features:

• Secure Runtime: The app runs in a secure, isolated runtime environment managed by Atlassian, preventing direct access to the underlying host system.
• Secure Storage: All app configuration and user data (personal issue notes) is stored securely within the Atlassian Forge infrastructure, leveraging Atlassian's own database security controls.
• Scoped Permissions: The app requests the minimum necessary permissions from Atlassian to function. It requests read:jira-work and write:jira-work to interact seamlessly with the Jira issue context, and uses native Forge storage to securely save individual user notes. We do not request broader permissions.

3. Data Protection

We implement several layers of data protection to ensure the confidentiality and integrity of your information:

• Data in Transit: All communication between the user's browser, Atlassian's infrastructure, and our Forge app is encrypted using industry-standard TLS 1.2 or higher.
• Data at Rest: All data stored by the app is encrypted at rest within the Atlassian Forge managed databases. We do not store any sensitive data outside of this secure environment.
• Data Minimization: The app is designed to collect and store only the data that is absolutely necessary for its functionality. We do not collect personal user information beyond what is required for app operation.
• No Data Exfiltration: The app is configured to prevent any data from being sent to external third-party services or endpoints. All data processing and storage remains within the secure Atlassian ecosystem.

4. Access Control

Access to our development and deployment infrastructure is strictly controlled:

• Developer Access: Access to the app's source code and deployment pipelines is restricted to authorized developers only.
• Principle of Least Privilege: Each developer account has only the permissions required to perform their specific role.
• Multi-Factor Authentication (MFA): All accounts with access to development and deployment tools are protected with MFA.

5. Secure Development Lifecycle

We follow secure development practices to minimize vulnerabilities:

• Dependency Management: We regularly review and update all third-party libraries and dependencies to their latest stable versions to patch known vulnerabilities.
• Code Reviews: All code changes undergo a review process before being deployed to production.
• Static Analysis: We use automated tools to scan our code for potential security flaws during the development process.

6. Vulnerability Management

We have a formal process for managing security vulnerabilities:

• Responsible Disclosure: We welcome the responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to us immediately at the email address below and allow us time to investigate and address the issue before making it public.
• Incident Response: In the event of a confirmed security incident, we will promptly investigate and take appropriate action to mitigate the risk, including notifying affected customers and Atlassian if required.

7. Atlassian Marketplace Compliance

By installing this app, you acknowledge and agree that your use of the app is also governed by the Atlassian Cloud Terms of Service. We are an independent developer and are not affiliated with Atlassian. We are committed to complying with all of Atlassian's security and vendor guidelines for Marketplace apps.

8. Contact Information

If you have any questions about this Security Policy or wish to report a security vulnerability, please contact us: