01Architecture

The app is a single Forge jira:globalPage module backed by static Custom UI assets. There is no Forge resolver, no Forge remote backend, and no external API the app calls other than Jira's own REST API, invoked through @forge/bridge's requestJira().

Every action the app takes runs in the authenticated context of the person using it — the app cannot do anything a user couldn't already do by hand in the Jira UI, and it never elevates to app-level permissions.

02Data handling

• Files selected for upload are read directly from the browser's local File API and sent straight to Jira's attachment endpoint — they are never transmitted to, or held by, any server we operate.
• No file contents, filenames, issue data, or user data are logged, stored, or retained by the app in any form.
• No analytics, tracking, or telemetry of any kind is collected.
• No cookies are set by the app itself.

03Encryption

Because the app stores no data of its own, there is no data-at-rest to encrypt and no backups to protect — the only copy of any file a user uploads lives in their own Jira site, governed entirely by Atlassian's own encryption and security controls for Jira Cloud. All traffic between the browser and Jira uses HTTPS/TLS, enforced by the Forge platform and the browser itself; the app has no custom transport layer to secure.

04Authentication & scopes

The app requests the classic scopes read:jira-work and write:jira-work — nothing broader. It never collects, stores, or asks for Atlassian account credentials, API tokens, or passwords, and it never collects credentials for any third-party service, because it doesn't integrate with any.

05Dependency management

Open-source dependencies are scanned with npm audit before every release. As of the most recent release, both packages in this project report zero known vulnerabilities. Dependencies are kept current as part of ongoing maintenance.

06Vulnerability management

We follow Atlassian's Marketplace security bug fix policy timelines for any reported vulnerability: critical issues within 10 days, high within 4 weeks, medium within 12 weeks, and low within 25 weeks. In the event of a security incident, we will notify Atlassian within 24 hours and affected customers within approximately 72 hours, per Atlassian's incident notification guide.

07Certifications

Bulk Attach for Jira is built and maintained by a solo developer. We do not currently hold formal compliance certifications (ISO 27001, SOC 2, PCI, HIPAA, or similar) or a completed CAIQ Lite questionnaire. Given the app's architecture — no server, no data storage, no third-party data sharing — the practical security surface these certifications would cover does not exist for this app. This is disclosed honestly rather than claimed without basis.

08Reporting a security issue

If you believe you've found a security issue with this app, please email security@abuzararif.xyz. We aim to acknowledge reports promptly and will keep you updated as we investigate.