Partner Security Policy

1. Scope

This policy describes how security concerns are reported and handled for Client Status Snapshot, an Aigeeza Apps product that runs on Atlassian Forge inside Jira Cloud. It covers the app code and the procedures the maintainer follows. Atlassian operates Jira Cloud and the Forge platform, including their underlying infrastructure security; those platform controls are governed by Atlassian. The app is not produced by Atlassian.

2. Reporting a security concern

If you believe you have found a vulnerability or other security issue in Client Status Snapshot, please report it privately to [email protected]. A useful report includes a description of the issue, the steps to reproduce it, the affected area of the app and any relevant screenshots.

Please do not include passwords, API tokens, personal access tokens or unnecessary customer or Jira content in your report. We ask that you avoid actions that could disrupt other customers or access data that is not your own while investigating.

We acknowledge good-faith reports and will keep the reporter informed of progress. We do not operate a paid bug-bounty programme.

3. How reports are assessed and fixed

When a report is received, the maintainer follows a consistent process:

Assess. Confirm the report, reproduce the issue where possible and determine whether it is a genuine security concern.
Prioritise. Judge the severity based on impact and exploitability, with issues that could expose customer data or the read-only permission model treated as the highest priority.
Fix. Develop a correction in the app code, addressing the underlying cause rather than only the reported symptom.
Test. Verify the fix and check that the app’s read-only behaviour, permission scope and no-storage design remain intact before release.
Release. Publish the corrected version through Atlassian’s Forge deployment and distribution process.

Client Status Snapshot is maintained by a small team, so timelines depend on the severity and complexity of each issue. We prioritise higher-severity issues and do not publish fixed response-time guarantees.

4. Incident investigation and reporting

If a security incident affecting the app is identified, the maintainer will investigate to understand what happened and which areas are affected, take steps to contain the issue — for example by correcting the app code and releasing an updated version — and work to prevent recurrence.

Where an incident involves the Forge platform, or where Atlassian’s notification requirements apply, we will report to Atlassian through the appropriate developer and security channels. Where an incident materially affects specific customers, we will notify those affected customers where appropriate and provide relevant information to help them respond. Because the app holds no persistent customer data of its own, notifications are focused on the nature of the issue and any action customers may need to take.

5. Security controls

The app’s design keeps its security surface deliberately small:

Atlassian Forge hosting. The app runs on Atlassian Forge and relies on Forge authentication, tenant isolation and Jira permission enforcement.
Read-only, least-privilege access. The app requests only read:jira-work. It does not request Jira write access, storage or personal-data reporting permissions.
No persistent app storage. The app has no database and does not persist Jira data, project selections, reporting periods or executive summaries. The report is reconstructed from Jira each time.
No external data egress. The app declares no external egress and has no developer-operated backend, remote API, analytics service or external database. Jira data is not sent to Aigeeza Apps or third parties.
No Jira content logging. The app is designed not to log issue content, report text, executive summaries, credentials, tokens or secrets. Operational failures may appear in Atlassian-hosted Forge logs.
Limited maintainer access. The app is maintained by Chris May trading as Aigeeza. Because the app stores no customer data outside Jira, the maintainer has no app-side store of customer Jira content to access.
Dependency maintenance. The maintainer keeps the app’s code and its dependencies up to date and reviews them when addressing reported issues and preparing releases.

6. Shared responsibilities

Aigeeza Apps is responsible for secure app code, dependency maintenance, vulnerability handling and accurate disclosures for Client Status Snapshot. Atlassian is responsible for the security of Jira Cloud and the Forge platform. Customers are responsible for managing their own Jira user accounts, permissions and site configuration, and for how exported reports are handled once copied or saved from the app.