Orgonaut
OrgSpec Marketplace documentation

OrgSpec for Jira security

Security architecture, permissions, data protection, vulnerability handling, and disclosure guidance for OrgSpec for Jira.

Last updated: 2026-07-08

OrgSpec for Jira security

This page describes the security practices and boundaries of the current OrgSpec for Jira Marketplace app. For information about personal data and exports, see the separate OrgSpec for Jira privacy policy.

Hosting architecture

OrgSpec for Jira is a Jira Cloud app built on Atlassian Forge.

The current version consists of:

  • A Forge jira:globalPage Custom UI.
  • A Forge resolver that maps Jira metadata into OrgSpec and validates the generated document.
  • Static frontend assets deployed with the Forge app.

The app does not use an external application server, external database, remote API, web trigger, or third-party analytics service.

Authentication and access

Atlassian controls app installation and Jira authentication. The app acts as the current Jira user and can only read Jira information that user is permitted to access.

The app does not ask users for Jira passwords, personal access tokens, API tokens, or shared secrets.

Jira permissions

The current version requests these read-only Jira scopes:

  • read:jira-work
  • read:project:jira
  • read:board-scope:jira-software
  • read:sprint:jira-software
  • read:issue-details:jira

These scopes are used to read visible project, board, sprint, component, and selected issue metadata. The app does not request Jira write scopes, administrative write scopes, Forge storage permissions, external fetch permissions, billing scopes, or Orgonaut API access.

Data handling

Jira metadata is read through Atlassian Forge as the current user. It is normalized in the app and passed to the Forge resolver to generate:

  • OrgSpec JSON.
  • A Jira source contract.
  • A mapping report.
  • An OrgSpec validation result.

The current version does not read issue descriptions, comments, attachments, worklogs, or changelog history.

Storage and data transfer

The app does not use persistent Forge storage or a partner-operated database.

Generated data remains in browser session state while the app page is open. The app does not send Jira data to Orgonaut or another external service.

Export files are created only when a user downloads them. After download, storage and access to those files are controlled by the user and their organisation. Exports can contain Jira account identifiers and should be handled as internal organisational data.

Encryption boundary

Communication with Jira and Forge uses Atlassian-managed platform connections. The partner does not operate a separate network service or persistent data store for this version of the app.

Downloaded exports are outside the Forge application boundary. Customers should use their organisation's approved device encryption, file storage, access control, and retention practices for those files.

Logging

The app does not intentionally log issue content, credentials, API tokens, downloaded exports, or Jira account identifiers.

Atlassian may retain platform-level operational information for Forge according to Atlassian's own service and security practices. OrgSpec for Jira does not export those platform logs to an external logging service.

Secure development and deployment

The current release process includes:

  • Dependency locking through package-lock.json.
  • Software composition analysis through npm audit before release.
  • Forge linting before deployment.
  • Production asset builds before deployment.
  • Production deployment and installation verification.
  • Live verification of Jira scanning, OrgSpec generation, validation, and exports.
  • Review of requested scopes and external-service declarations when app behavior changes.

No independent penetration test, formal security certification, or external security audit is claimed for the current version.

Vulnerability management

Security reports are assessed against the current Forge app, dependencies, permissions, and data boundary. Confirmed issues are prioritised according to their likely impact and exploitability.

Depending on severity, remediation may include updating dependencies, changing application code or permissions, deploying a corrected Forge version, disabling affected behavior, and notifying Atlassian or affected users where required.

Security claims and this page must be reviewed whenever the app adds storage, external egress, new Jira permissions, analytics, billing, or an external integration.

Security incident handling

Potential security incidents are triaged through the security contact below. The response includes preserving relevant evidence, assessing affected data and tenants, containing the issue, deploying a fix or mitigation, and notifying Atlassian or affected users when required.

The current incident process requires prompt notification to Atlassian, no later than 24 hours after identifying an incident when Atlassian's incident guidance applies. Affected customers are notified when appropriate, targeting 72 hours from identification where the facts and applicable obligations allow. Each incident ends with root-cause and remediation review.

Do not send passwords, API tokens, identity documents, or sensitive customer exports in an initial report.

Report a security issue

Email:

  • support@orgonaut.co

Use the subject Security report: OrgSpec for Jira and include:

  • A concise description of the issue.
  • The affected app screen or workflow.
  • Reproduction steps that do not expose customer data.
  • The expected and observed behavior.
  • Any known impact.

Current security posture

The current Marketplace version is free and uses no persistent app storage, external egress, external analytics, billing integration, AI service, or Orgonaut integration.

Last reviewed: August 25, 2026.