Security Policy
1. Our Approach
sielTrace is built on the Atlassian Forge platform, which provides infrastructure-level security (hosting, encryption at rest, network isolation) as part of the platform. Our security responsibilities focus on how the app uses that platform: permission checks, secret handling, tenant isolation, and safe defaults.
2. Authentication and Authorization
- All actions on behalf of a user (creating or updating Jira issues, reading Confluence pages) run in that user's own permission context via Forge's
asUser()API. The app does not escalate privileges on the user's behalf. - Administrative operations (plan changes, connecting repositories, configuring AI providers) are restricted server-side to users holding Jira's global ADMINISTER permission, verified on every request — never trusted from the frontend alone.
3. Secrets Management
- Repository access tokens and BYOK (Bring Your Own Key) AI provider keys are stored using Forge's encrypted secret storage (
kvs.setSecret), which is encrypted at rest and excluded from regular data listings. - Secrets are never written to application logs or included in error messages.
- sielTrace does not collect or request Atlassian account passwords or Personal Access Tokens (PATs). Jira and Confluence access is granted exclusively through Forge's standard app installation and scope model.
4. Tenant Isolation
All stored data (business rules, repository configuration, refinement history) is partitioned by organization ID. No operation performed in the context of one Atlassian site can read, modify, or delete data belonging to another site.
5. Data in Transit
All communication with Atlassian APIs, connected repository providers (GitHub, GitLab, Bitbucket, AWS CodeCommit), and AI providers (Forge LLM or BYOK) occurs over encrypted HTTPS/TLS connections. Outbound destinations are explicitly declared in the app manifest.
6. Vulnerability Management
- Third-party dependencies are reviewed for known vulnerabilities before releases.
- We follow Atlassian's Marketplace Security Bug Fix Policy for triaging and remediating reported issues.
7. Reporting a Security Issue
If you believe you've found a security vulnerability in sielTrace, please report it to sieltrace@gmail.com with the subject line "Security Report". Please include steps to reproduce and any relevant details. We aim to acknowledge reports within 3 business days and will keep you informed as we investigate and address the issue.
Please do not publicly disclose a vulnerability before we've had a chance to address it.
8. Incident Notification
In the event of a security incident affecting customer data, we will notify affected customers and Atlassian without undue delay, consistent with our obligations under the Atlassian Marketplace Partner Agreement.
9. Changes to This Policy
We may update this Security Policy from time to time. Changes will be posted with a new "Last Updated" date.