Security Policy
This Security Policy describes how AD Lab Development secures Atlassian Forge apps we publish on Marketplace (including RiskPilot and Ticket Quality Auditor).
1. Platform (all Apps)
- Apps run on Atlassian Forge (functions, Forge app storage / KVS, optional Forge LLMs)
- Designed for Runs on Atlassian eligibility: no third-party AI egress and no Remotes/Connect backends for core functionality
- User-initiated actions use the Forge Authorize API before
asApp()Jira access where applicable - Customers are not asked for Atlassian passwords or shared API secrets
- Structured operational logs with secret redaction; logs remain in Forge logging
- No remote REST APIs exposed by our Apps for third-party integration
2. RiskPilot — permissions
read:jira-work— read issues and links for analysiswrite:jira-work— optional audit comments when enabled in admin (user must have edit permission)storage:app— configuration, analysis snapshots, outcomes, register
3. Ticket Quality Auditor — permissions
read:jira-work— read issue content and receive issue eventswrite:jira-work— apply confirmed Improve Ticket updates onlystorage:app— configuration and analysis results
4. Vulnerability reporting
Report suspected security issues to security@adlabdevelopment.com. Include reproduction steps. Avoid sending production secrets in clear text.