This Security Policy outlines the measures that protect your data when you use Special Messages for Jira.
2. Forge Architecture
The App is built natively on the Atlassian Forge platform:
No data egress: the App does not communicate with any external server, CDN or third-party API. Its code is bundled and served by Atlassian.
Isolated runtime: the App runs in Atlassian's isolated, managed Forge environment.
3. Scoped Permissions
The App requests only the Atlassian API scopes it needs:
read:jira-work: to evaluate message conditions against work items and to list spaces and work types.
read:jira-user: to record the name of the administrator who last changed a message.
storage:app: to keep the message configuration in Forge storage.
4. Data Protection
Data in transit: all communication with Jira's APIs is encrypted with TLS.
Data at rest: any data the App keeps stays in your Atlassian site, protected by Atlassian's encryption standards.
Administrator-only configuration: messages can only be created or changed from the app's admin page in Jira settings, which only Jira administrators can open; the app also refuses configuration changes from any other screen.
Your permissions apply: message conditions are evaluated as the person viewing the work item.
No remote content: images in message text are removed on save, so displaying a message never makes a viewer's browser contact another site.
5. Vulnerability Management
We welcome the responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to us at the email address below.