Security

Last updated October 6, 2026

Architecture

Issue Type Rules is a Forge app. Its code runs and its data is stored on Atlassian's infrastructure. It has no servers, databases or third-party services of its own, and declares no external network access (egress).

Access

• Scopes requested: read:jira-work, write:jira-work, read:jira-user, manage:jira-configuration, manage:jira-project, read:app-data:jira, write:app-data:jira, storage:app. The write, configuration and app-data scopes are what Jira requires to manage UI modifications and the app's properties.
• The app never reads, creates or edits issues' content. It looks up the issue type and project of a chosen parent issue only.
• Every settings action checks on the server that the caller has the Jira administrator permission, not just that the page was shown to them.
• The Create dialog part only answers for the signed-in person: whether they belong to the groups and roles the project's rules name, and the type of a parent issue, only if Jira's permissions (including issue security) let them see it.
• Short-lived lookups held in memory are kept separate per Jira site.
• The rules the workflow validator reads are kept in app properties, which only the app can change, so project administrators can't edit them to get around a rule.

Development practices

• Source code is kept in a private repository with access limited to the vendor.
• Dependencies are limited to Atlassian's Forge packages and React, and are reviewed for known vulnerabilities before each release.
• Deployment credentials are stored as secrets and never committed.

Reporting a vulnerability

Email support@steadyfield.atlassian.net with the subject "Security". We acknowledge reports within 2 business days and aim to fix confirmed vulnerabilities within Atlassian's timelines: critical within 10 days, high within 4 weeks, medium within 12 weeks, low within 25 weeks.

Incident response

If we learn of a security incident affecting customers, we will contain it, report it to Atlassian within 24 hours, notify affected customers without undue delay, and publish what happened and what we changed.