Security policy

This policy covers all Relay Studio apps for Jira and Confluence.

How the apps are built

Every app runs on Atlassian’s Forge platform. None declares permission to contact servers outside Atlassian, so no data can leave it.
Apps ask only for the scopes they need; each app’s documentation lists every scope and why.
Content is read as the person using the app, so Jira’s and Confluence’s own permissions apply to every request.
Data an app keeps is stored in Forge hosted storage, inside Atlassian, separated per site.
No passwords, API tokens or other secrets are requested or stored.
Dependencies are checked for known vulnerabilities before every release.

Reporting a vulnerability

Write to support@relaystudio.org with “Security” in the subject: the app, what you found, and steps to reproduce. Reports are acknowledged within one working day. Please give us time to fix the issue before publishing it, and do not access data that is not yours while testing.

Fix times

Confirmed vulnerabilities are fixed within the deadlines of Atlassian’s Security Bug Fix Policy for cloud apps:

Critical: 10 days
High: 4 weeks
Medium: 12 weeks
Low: 25 weeks

Incidents

If a security incident affects customer data, we inform the affected customers and Atlassian without undue delay, with what happened, what data is affected and what we are doing about it.