Перевод для удобства. При расхождении действует английская версия.

Security

ArtUp Trace for Jira Cloud · ArtUp Export for Confluence Cloud · ArtUp Reports for Jira Cloud · ArtUp Query for Jira Cloud · Last updated: 2026-10-05

1. Architecture

ArtUp Trace is built entirely on Atlassian Forge and carries Atlassian's "Runs on Atlassian" designation. This means:

• The App's code executes inside Atlassian's infrastructure, not on a server operated by ArtUp Labs. ArtUp Labs runs no external servers for the App.
• The App has no outbound network calls (no egress). It cannot send Jira data anywhere outside Atlassian.
• The App's own data (project settings, requirement and link records, baselines, sync job metadata) is stored only in Forge SQL and Forge storage, in the customer's data residency region as handled by Atlassian.
• The App loads no third-party analytics, trackers or advertising scripts. This website loads no trackers or advertising scripts; it counts page views in aggregate with Cloudflare Web Analytics, which sets no cookies (see the Privacy Policy).

See the Privacy Policy for the full list of what is stored.

1.1 ArtUp Export

ArtUp Export is also built entirely on Atlassian Forge, with no external servers, no Connect modules and only bundled resources.

• Pages, attachments, labels and user names are read in the user's browser, through Atlassian's API and with that user's Confluence permissions. Conversion to Markdown and packing of the zip happen in the browser, and the zip is downloaded to the user's device.
• The app has no outbound network calls (no egress). Confluence content is not sent to the app's backend, to ArtUp Labs or anywhere outside Atlassian and the user's browser.
• The app stores no data: no Forge storage is used, although the storage:app scope is declared for future versions.
• Its only backend function returns whether the licence is active. It receives no page content, so its Forge logs contain no Confluence content.

1.2 ArtUp Reports

ArtUp Reports is also built entirely on Atlassian Forge, with no external servers, no Connect modules and only bundled resources (fonts for Latin, Cyrillic and CJK text, libraries and images).

• Issues, attachments and user names are read in the user's browser, through Atlassian's API and with that user's Jira permissions. The Excel, Word or PDF file is built in the browser and downloaded to the user's device.
• The app has no outbound network calls (no egress). Issue content is not sent to the app's backend, to ArtUp Labs or anywhere outside Atlassian and the user's browser.
• The app stores only export templates in Forge storage: names, settings, Excel column sets, uploaded .docx template files and the Atlassian account id of each template's author. No issue content is stored or logged.
• Its backend functions manage templates and check the current user's Jira permissions. On failure, Forge logs contain only the function name and the error message.

1.3 ArtUp Query

ArtUp Query is also built entirely on Atlassian Forge, with no external servers, no Connect modules and only bundled resources. It adds JQL functions to Jira (jira:jqlFunction), a reference and status page, and an administration page.

• The app has no outbound network calls (no egress). Work item data is read through Atlassian's API and never leaves Atlassian.
• It reads work items, links, the hierarchy, the changelog for Sprint and status, and comment and attachment metadata as the app, and never writes to work items, comments or issue properties. The results of a function are the same for every user and are applied by Jira to the user's own search, so Jira's own permissions still hide work items the user cannot see.
• The index is stored in Forge SQL and Forge storage: ids, dates, status categories, the account ids of comment and attachment authors, comment visibility type, file extensions and cached result ids. Issue text, comment bodies and attachment content are never stored. Comments with restricted visibility are ignored by every function.
• Only Jira administrators can change the settings (excluded projects, reindex, rebuild). The app's error log stores the function name and the message, never the function arguments.

2. Access scopes and permissions

The App follows the principle of least privilege. It requests only the Atlassian scopes it needs, and nothing more:

ArtUp Trace requests no write scopes for Jira issues. It reads Jira data as the current user, so it can only see what that user is already permitted to see in your Jira site, and it never writes to Jira issues.

Beyond the scopes above, the App performs a Jira permission check on every user-facing action before it acts — for example before showing an issue's traceability data or before recording a link confirmation — so a user cannot use the App to see or affect anything their own Jira permissions would not already allow.

ArtUp Export requests only read scopes. It reads Confluence as the current user, so pages the user cannot see are not exported, and it never writes to Confluence.

ArtUp Reports requests only read scopes and storage:app. It reads Jira as the current user, so issues the user cannot see in Jira are not exported, and it never writes to Jira. Before a user creates, changes or deletes a project or site template, the backend checks that user's Jira permissions (project administration for a project template, Jira administration for a site template); a personal template is visible only to its author.

ArtUp Query reads Jira as the app and requests one write scope, write:app-data:jira, which is used only to store the app's JQL function precomputations. It requests no write:jira-work and no manage:* scope, and it never writes to work items.

3. Application security controls

• Permission checks on every action. Every user-facing operation re-checks the calling user's Jira permissions at the time of the request; nothing is cached in a way that could grant stale access.
• Input validation. All input from the front end, from Jira webhooks, and from imported data (for example CSV or configuration values) is validated before it is stored or used to build a query, to guard against malformed or malicious input.
• No egress, no trackers. Because the App cannot make outbound network calls, there is no path for it to exfiltrate data even if a dependency were compromised.
• ArtUp Export: untrusted files are checked. A previous export dropped in for an update is read in the browser, and paths from its manifest that could point outside the export folder are refused.
• ArtUp Reports: uploaded templates are checked. A Word template must be a valid .docx file of at most 2 MB that unpacks to no more than 20 MB, and its placeholders are checked before it can be saved.
• ArtUp Query: arguments are not logged. Function arguments contain the customer's JQL, so the error log keeps only the function name and the message. Conditions, dates and expressions are parsed by the app and refused with a message when invalid.
• Least-privilege storage. Only the fields needed for traceability are stored; see the Privacy Policy for the exact list. Full issue description text is never stored, only a change-detection hash.

4. Dependency and supply-chain security

• Automated scanning. npm audit runs as part of the build, and Dependabot is enabled on the source repository to flag known vulnerabilities in dependencies and open update pull requests automatically.
• Review before release. Dependencies are checked for known vulnerabilities before every release, not only on a schedule.
• Minimal dependency footprint. The App uses as few third-party packages as practical, to reduce supply-chain exposure.

5. Account and workstation security

• Multi-factor authentication (MFA) is enabled on the developer's Atlassian, source control, email, DNS and app-store accounts.
• Full-disk encryption and automatic OS updates are enabled on the development workstation.
• Unique, generated passwords are used and kept in a password manager.
• Secrets and credentials are kept out of source control and rotated periodically and immediately after any suspected exposure.

6. Reporting a vulnerability

If you believe you have found a security vulnerability in ArtUp Trace, ArtUp Export, ArtUp Reports, ArtUp Query or on this website, please email [email protected] with:

• a description of the issue and its potential impact;
• steps to reproduce it, including any request or response details that help us confirm it;
• whether any customer data was, to your knowledge, affected.

Please do not include Jira or Confluence content beyond what is strictly needed to demonstrate the issue, and do not test against customer sites you do not control. We will acknowledge your report within 24 hours and keep you updated as we investigate and fix it. We currently do not run a paid bug bounty programme.

7. Incident response

ArtUp Labs follows a written incident response plan for every Marketplace app, owned by the security contact below and reviewed at least once a year and after every incident.

7.1 What counts as an incident

• Unauthorised access to customer data held by an app (Forge SQL, Forge storage).
• A vulnerability in an app that exposes customer data or lets a user act beyond their Jira or Confluence permissions.
• Compromise of a developer account, workstation, source repository or deployment credentials (Atlassian account, Forge token, source control, domain/DNS, email).
• A report from Atlassian (Marketplace Security ticket, bug report) or from a customer about any of the above.

7.2 Detection channels

• [email protected] and [email protected], checked daily on business days.
• Atlassian Marketplace Security (AMS) tickets on ecosystem.atlassian.net.
• The Forge developer console: app logs, invocation errors and alerts.
• Dependency alerts (npm audit, Dependabot).

7.3 Response steps

7.4 Preventive controls

• Full-disk encryption and automatic OS updates on the development workstation.
• Multi-factor authentication on Atlassian, source control, email, DNS and app-store accounts.
• Unique passwords kept in a password manager; secrets kept out of source control and rotated regularly and after any suspected exposure.
• The Apps run on Atlassian (Forge) with no external egress, least-privilege scopes, and a permission check on every user-facing operation.
• Dependencies are checked for known vulnerabilities before every release.

8. Contact

Security contact: [email protected]. For general questions, see our Support page. For what data is stored and how, see our Privacy Policy.