Skip to content
Inventerprises

Security policy

Last updated 2026-10-29

If you have found a security problem in one of our apps, we want to hear about it. This page says how to report it, what is in scope, and what to expect from us.

How to report

Email alexander@inventerprises.se with "Security" in the subject line. Please include:

  • Which app, and which version or date you tested.
  • What the problem is and what an attacker could do with it.
  • Steps to reproduce, with any proof of concept.
  • How you would like to be credited, if at all.

Do not include other people's personal data in a report.

Scope

In scope:

Out of scope:

  • Atlassian's own products and the Forge platform. Report those to Atlassian through its security program.
  • Denial of service, load testing, spam, and social engineering.
  • Findings that need a compromised device or administrator account, or that only affect outdated browsers.

Testing rules

Test only on a Jira Cloud site you own, such as a free developer site. Do not access, change or delete data that is not yours, and stop as soon as you reach someone else's data. Give us reasonable time to fix a problem before you disclose it. If you follow these rules in good faith, we will not take legal action against you for your research, and we will treat your report as confidential.

What to expect

Acknowledgement
Within 2 business days.
First assessment
Within 5 business days, including a severity rating based on CVSS.
Fix, critical
Within 14 days.
Fix, high
Within 28 days.
Fix, medium
Within 42 days.
Fix, low
Within 175 days.

We keep you informed until the problem is fixed and tell you when it is. We agree a disclosure date with you, normally once the fix is live or 90 days after your report, whichever comes first. We do not run a paid bug bounty.

If a vulnerability has exposed customer data, we notify affected customers as our Data Processing Addendum requires.

How the apps handle data

  • The apps are built on Atlassian Forge and carry the "Runs on Atlassian" label. They run and store data on Atlassian's infrastructure.
  • No egress: the apps send no data outside Atlassian, and we run no servers that receive Jira data.
  • Each app requests only the Jira scopes it needs. Production Telemetry is read-only.
  • App data in Forge storage is deleted by Atlassian after uninstall, under Forge's data retention rules.
  • Atlassian is the only subprocessor. See the Privacy policy for what each app stores.

Contact

Inventerprises AB, Malmö, Sweden. alexander@inventerprises.se. For help that is not a security issue, see Support.