plugins factoryContact us

Security

Review security controls and release practices for AssetPilot and AssetPilot Connect, plus vulnerability reporting instructions and response commitments.

Last updated

This page describes security controls and working practices for AssetPilot for Jira and AssetPilot Connect. It also explains how to report a vulnerability; Connect is in beta (pre-release).

How the apps are built

  • Atlassian Forge only. Code runs in the Forge runtime, and app data is stored in Forge storage. We run no servers, databases or queues. AssetPilot makes no calls outside Atlassian.
  • Encryption. Atlassian provides TLS 1.2+ in transit and encryption at rest.
  • Least privilege. Each app requests only the scopes its features use. The documentation lists each scope and its purpose. User actions run as the user, so Jira permissions apply.
  • Secrets. Connect keeps credentials in Forge secret storage and never returns them to the browser. API keys are stored as SHA-256 hashes. OAuth access tokens stay in memory only until they expire.
  • Webhooks. Requests use HMAC-SHA256 signatures with a timestamp. URLs must use https; private and link-local addresses are refused.
  • Logs. Function logs contain no personal data or secrets. Product audit and sync logs have different contents; see data handling.
  • No AI. See the AI policy.

How we work

  • Multi-factor authentication on source code, cloud, email and Atlassian accounts.
  • Code review and automated tests before every release.
  • Vulnerability fixes within Atlassian’s Security Bug Fix Policy timeframes for cloud apps: critical within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks of triage.
  • Incident handling as described in incident response.

Report a vulnerability

Send the app and version, the steps to reproduce and the impact to security@plugins-factory.com. The mailbox is monitored 24/7.

The security mailbox monitoring commitment is 24/7. The reporting commitments are:

  • We acknowledge reports within 1 day and triage them within 3 days.
  • We keep you informed and, if you want, credit you when the fix ships.
  • We will not take legal action against good-faith research that follows this policy: test only on a Jira site you own, do not access other customers’ data, do not degrade the service, and give us reasonable time to fix the issue before publishing.

Machine-readable contact: /.well-known/security.txt.