Korinvale Software
Security overview

A deliberately small security surface.

Notification Hygiene for Jira is Forge-hosted, GET-only in its Jira integration, and built without an external backend or data egress.

Architecture

  • Atlassian Forge hosts the UI, functions, scheduler, and KVS storage.
  • The app declares no remote backend and no external egress.
  • No external database, analytics, advertising, or AI service is used.
  • Interactive requests use the signed-in Jira user’s permissions.
  • The daily scheduled read runs as the installed app because no user context exists.
  • The Jira admin page is limited to global administrators.

Permissions and read-only boundary

Jira requires the configuration scope for notification-scheme read endpoints. Application code uses that scope only for these GET requests:

  • GET /rest/api/3/notificationscheme
  • GET /rest/api/3/notificationscheme/project

V1 contains no Jira configuration mutation path.

Stored data

Forge KVS stores snapshot timestamps, scheme identifiers and names, SHA-256 configuration fingerprints, up to 20 compact change records, and latest scheduled-scan status. Recipient details, account IDs, group names, project roles, email addresses, credentials, raw Jira responses, and event configuration are not persisted.

Engineering controls

  • TypeScript checking and deterministic unit tests before release.
  • Narrow Jira and storage integration boundaries.
  • Bounded pagination that must advance.
  • Canonical-content verification for exact comparisons.
  • Safe user-facing errors without raw response bodies or credentials.
  • Explicit release review for scope, egress, endpoint, and dependency changes.

Reporting guidance

Include the affected version, reproduction steps, expected impact, and evidence. Korinvale Software will triage the report, contain risk, coordinate with Atlassian when required, test and deploy a fix, and record preventive actions.