This page describes how we detect, handle and report incidents affecting AssetPilot for Jira and AssetPilot Connect. Connect is in beta.
Detection
We use these sources to identify incidents:
- Forge function errors and invocation metrics in the Atlassian developer console.
- Atlassian security notifications, Marketplace security scans and partner escalations.
- Customer reports through support and researcher reports to security@plugins-factory.com.
- Atlassian platform incidents on developer.status.atlassian.com.
Classification
| Severity | Examples | Target to mitigate |
|---|---|---|
| SEV1 | Security breach, data exposure or loss, or an app unusable for all customers | Within 24 hours |
| SEV2 | A main feature broken for many customers, such as stopped syncs or webhooks | Within 3 days |
| SEV3 | A feature broken for some customers, with a workaround | In the next release |
We also rate security vulnerabilities with CVSS and fix them within the timeframes in Atlassian’s Security Bug Fix Policy.
Response
- Acknowledge the incident and name an incident lead.
- Contain it by disabling the affected module, rolling back the Forge deployment or rotating credentials.
- Email the technical contacts of affected Jira sites. Update them at least every 4 hours for SEV1 and every day for SEV2.
- For a personal data breach, notify affected customers, who are the data controllers, without undue delay and within 48 hours of becoming aware of it.
- Report security incidents affecting customers to Atlassian and follow its collaborative incident response process. We answer Atlassian security alerts within 8 hours. The security mailbox is monitored 24/7.
After the incident
Within 5 days of resolving a SEV1 or SEV2 incident, we write a review covering the timeline, root cause, impact and follow-up actions with owners. Affected customers receive a summary.
To report an incident, follow the support instructions.