Security

Last updated October 6, 2026

Architecture

Field Defaults is a Forge app. Its code runs and its data is stored on Atlassian's infrastructure. It has no servers, databases or third-party services of its own, and declares no external network access (egress).

Access

• Scopes requested: read:jira-work, write:jira-work, read:jira-user, manage:jira-configuration, manage:jira-project, storage:app, read:app-data:jira, write:app-data:jira. The write, configuration and app-data scopes are what Jira requires to read, create and update UI modifications.
• The app never reads or edits existing issues. It only fills in the Create dialog, and the person creating the issue sees every value before saving.
• Every settings action checks on the server that the caller has the Jira administrator permission, not just that the page was shown to them.
• Short-lived lookups held in memory are kept separate per Jira site.
• Locking a field is a convenience, not an access control: it applies in the Create dialog only, and the value can be changed after the issue is created.

Development practices

• Source code is kept in a private repository with access limited to the vendor.
• Dependencies are limited to Atlassian's Forge packages and React, and are reviewed for known vulnerabilities before each release.
• Deployment credentials are stored as secrets and never committed.

Reporting a vulnerability

Email support@steadyfield.atlassian.net with the subject "Security". We acknowledge reports within 2 business days and aim to fix confirmed vulnerabilities within Atlassian's timelines: critical within 10 days, high within 4 weeks, medium within 12 weeks, low within 25 weeks.

Incident response

If we learn of a security incident affecting customers, we will contain it, report it to Atlassian within 24 hours, notify affected customers without undue delay, and publish what happened and what we changed.