Architecture
- Both apps run entirely on Atlassian Forge.
- No Sallux-operated servers, external databases, analytics, advertising, or AI providers.
- No remote hosts, IP allowlists, or external fetch permissions in either app manifest.
- Persistent app data uses Atlassian Forge hosted storage.
Permissions
Gatehouse
Gatehouse requests Jira read access to evaluate configured issue fields, present the project readiness view, verify project administration, and run the optional workflow validator. It requests Forge app storage for the readiness policy. It has no Jira write scope and does not persist issue content.
Page Steward
Page Steward requests only the Confluence access required for its bounded metadata scan, page-context indicator, configuration, and Forge-hosted review index. It does not request page bodies, comments, or attachments.
Engineering controls
- Resolver-side authorization and role checks on privileged operations.
- Bounded input handling and safe React output rendering.
- Locked dependencies, automated tests, dependency review, and software bills of materials.
- Structured operational logging designed to exclude customer content, identifiers, and credentials.
- Release verification before production deployment and Marketplace submission.
Reporting a vulnerability
Send suspected security issues privately to drew@sallux.dev with the subject prefix [SECURITY]. Include the app name and version, affected surface, safe reproduction steps, and impact. Do not include passwords, tokens, session cookies, customer content, or regulated data. Please allow a reasonable opportunity to investigate before public disclosure.
Important boundary
This overview describes the current release candidates and is not a certification, warranty of absolute security, or representation that any customer’s use satisfies a specific legal or regulatory framework. Atlassian controls Forge infrastructure and publishes its own security and compliance information.