STAGECRAFT FOR JIRA

Security

Reporting a vulnerability

Email support@veloxylabs.com with the subject "Security" and the steps to reproduce. We acknowledge within 2 business days, give a first assessment within 5 business days, and fix issues within the timeframes of Atlassian's Marketplace security bug fix policy: critical (CVSS 9.0 or higher) within 10 days, high (7.0 or higher) within 4 weeks, medium (4.0 or higher) within 12 weeks, low within 25 weeks. If a security incident affects customer data, we tell Atlassian within 48 hours. Please do not test against sites you do not own.

How Stagecraft is built

  • Forge app on Atlassian's infrastructure. No servers run by Veloxy Labs receive customer data. Storage is Atlassian's Forge hosted storage in the customer's site.
  • Acts as the user by default. Screens read Jira as the person using them. Where the app reads as itself (for example to compute a card's state, its child cards or the indicators), it checks the person's own Jira permission on that card or space, and lists only the cards they can see.
  • Least privilege. Only the scopes the features need. Settings shared by every space change only with the site's permission.
  • Secrets (API keys and tokens customers provide) live only in Forge secret storage, encrypted by Atlassian, never returned to the browser in full and never logged.
  • No personal data in logs beyond technical identifiers (work item keys, space and account IDs). Logs never include names, card content, search text or Jira response bodies.
  • Inputs validated and bounded on the server. Forge SQL is used only with bound parameters.
  • Outbound calls only to declared hosts or hosts a site admin approves, and only after a Jira admin turns on external services (off by default).
  • Personal data: account IDs only; weekly reporting to Atlassian's personal data API; closed accounts pseudonymised.
  • Licensing: without an active license the app stops and never blocks Jira workflows.
  • Dependencies checked with npm audit on every build and with OSV before each submission.

Data and privacy

See the Privacy Policy.