Security Policy

1. Overview

Autowork Studios takes the security of Issue Autopilot and its users' data seriously. This policy describes how we approach security across our app, how we handle vulnerability reports, and how we respond to security incidents.

Issue Autopilot is built exclusively on the Atlassian Forge platform, which provides a sandboxed execution environment with no external servers or databases operated by Autowork Studios. This significantly reduces the attack surface compared to traditionally hosted apps.

2. Platform Security Controls

Because the app runs entirely within Atlassian's Forge infrastructure, the following security controls are inherited from Atlassian's platform:

• Sandboxed execution — app code runs in Atlassian's managed runtime, isolated from other apps and tenants
• Encrypted storage — all data stored in Forge KV Store is encrypted at rest and in transit by Atlassian
• Scoped API access — the app can only access Jira APIs within the installing site, enforced by Atlassian's OAuth 2.0 permission model
• No external data transmission — no user data is sent to external servers; all processing occurs within the Atlassian platform
• Atlassian security certifications — Forge infrastructure is covered by Atlassian's SOC 2, ISO 27001, and other enterprise compliance certifications

For full details of Atlassian's infrastructure security controls, refer to Atlassian's Trust & Security page.

3. Application-Level Security Controls

The following controls are implemented within the app itself:

• Input validation — all template fields are validated before use, including format checks on project keys, issue keys, and custom field IDs, and length limits aligned with Jira's own constraints
• JQL injection prevention — user-supplied values inserted into JQL queries are escaped before use
• Principle of least privilege — the app requests only the Jira API scopes strictly necessary for its functionality; no admin or user-management scopes are requested
• User context enforcement — actions triggered manually by a user are executed via api.asUser(); scheduled actions use api.asApp() with no elevation of privilege
• No credential storage — the app never stores API tokens, passwords, or authentication credentials of any kind

4. Vulnerability Management

We monitor Atlassian's Forge platform release notes and security advisories for any changes that may affect the app. App dependencies are reviewed and updated regularly to address known vulnerabilities.

Because the app has no external infrastructure, the primary vulnerability surface is the app code itself and the Atlassian platform it runs on. Atlassian manages platform-level vulnerabilities; app-level vulnerabilities are addressed by Autowork Studios as described below.

5. Reporting a Security Vulnerability

When reporting a vulnerability, please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any supporting evidence (screenshots, logs, or proof-of-concept)
• Your contact details so we can follow up

We will acknowledge receipt of your report within 2 business days and provide an initial assessment within 5 business days. We are committed to resolving confirmed vulnerabilities promptly and will keep you informed throughout the process.

6. Incident Response

In the event of a confirmed security incident, Autowork Studios will:

• Investigate and contain the incident as quickly as possible
• Notify affected users if their data may have been compromised
• Remediate the root cause and deploy a fix
• Conduct a post-incident review to prevent recurrence
• Cooperate fully with Atlassian's incident response processes where applicable

Because all data is stored within Atlassian's Forge platform, any infrastructure-level incidents would be handled by Atlassian's security and incident response teams in accordance with their published policies.

7. Access Controls

Issue Autopilot has no backend systems operated by Autowork Studios, so there are no internal access control systems to manage. Access to the app's source code repository is restricted to authorised Autowork Studios personnel only, with access controls enforced via GitHub.

8. Contact

For security-related enquiries, please contact us at:

Autowork Studios
support@autoworkstudios.com