Security

A narrow, deterministic security boundary.

Workflow Linter is designed to inspect Jira workflow structure without moving Jira data to an external application server, analytics platform, advertising network, or AI provider.

Design commitments

Read-only Jira access

The app never sends a Jira mutation request.

No external egress

Jira workflow configuration stays within Atlassian services.

Minimal data access

No issue, comment, attachment, user-email, or customer-file scopes.

Bounded storage

Installation-scoped Forge storage with hard record and byte limits.

Deterministic analysis

No prompt injection surface and no customer data sent to an AI model.

Fail-closed licensing

Production checks reject inactive or missing licenses.

Requested permissions

manage:jira-configuration

Required by Jira's workflow search API. Used to read workflow structure. Workflow Linter does not mutate workflow configuration.

storage:app

Stores the bounded latest report, scan metadata, and intentional finding suppressions in installation-scoped Forge storage.

Data flow

Jira workflow API→Forge function→Graph rules→Forge storage→Jira admin page

No separate application server, database, analytics SDK, advertising SDK, or generative-AI provider participates in this path.

Operational safeguards

  • Retry limits and bounded pagination prevent unbounded API use.
  • Last-known-good results remain available after ordinary Jira API failures.
  • Public errors are classified without returning raw Jira response bodies.
  • The release gate covers static analysis, type checking, manifest validation, deterministic tests, and dependency auditing.

Report a vulnerability

Email security@workflowlinter.com. Include the app version, affected Jira Cloud URL with tenant-specific details removed where possible, reproduction steps, impact, and diagnostics output. Do not include credentials, API tokens, or sensitive issue content.

Response target

We acknowledge security reports within two business days and prioritize remediation based on verified impact.