Security

Last updated October 7, 2026

Architecture

Bulk Links is a Forge app. Its code runs and its data is stored on Atlassian's infrastructure. It has no servers, databases or third-party services of its own, and declares no external network access (egress).

Access

• Scopes requested: read:jira-work (searches and links), write:jira-work (creating and deleting issue links), storage:app (run history for undo).
• Every search and change is made as the signed-in user, so Jira applies that person's own permissions and issue security, and records them as the author.
• The app only creates and deletes issue links. It never edits, moves or deletes issues.
• Runs are private: each person can only see, resume or undo their own.

Development practices

• Source code is kept in a private repository with access limited to the vendor.
• Dependencies are limited to Atlassian's Forge packages and React, and are reviewed for known vulnerabilities before each release.
• Deployment credentials are stored as secrets and never committed.

Reporting a vulnerability

Email support@steadyfield.atlassian.net with the subject "Security". We acknowledge reports within 2 business days.

Incident response

If we learn of a security incident affecting customers, we will contain it, report it to Atlassian within 24 hours, notify affected customers, and publish what happened and what we changed.

Fix targets

We aim to release fixes for confirmed vulnerabilities within Atlassian's timeframes for Marketplace apps: critical within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.