Security

Last updated October 6, 2026

Architecture

Sprint Ledger is a Forge app. Its code runs and its data is stored on Atlassian's infrastructure. It has no servers, databases or third-party services of its own, and declares no external network access (egress).

Access

• Scopes requested: read:jira-work, read:jira-user (only to read the site time zone), read:sprint:jira-software, write:app-data:jira, storage:app.
• The app writes only to its own custom fields.
• The settings page is only available to Jira administrators, and the app checks the admin permission again before starting or cancelling a scan.

Development practices

• Source code is kept in a private repository with access limited to the vendor.
• Dependencies are limited to Atlassian's Forge packages and React, and are reviewed for known vulnerabilities before each release.
• Deployment credentials are stored as secrets and never committed.

Reporting a vulnerability

Email support@steadyfield.atlassian.net with the subject "Security". We acknowledge reports within 2 business days.

Incident response

If we learn of a security incident affecting customers, we will contain it, report it to Atlassian within 24 hours, notify affected customers, and publish what happened and what we changed.

Fix targets

We aim to release fixes for confirmed vulnerabilities within Atlassian's timeframes for Marketplace apps: critical within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.