Security

This page is for people who want to report a security problem in a Datadelight app, and for people who want to know what each app can reach. It states only what the apps' code and manifests show. Datadelight is the vendor of every app listed here.

Report a vulnerability

Email support@accounts.datadelight.co with the subject "Security". Tell us which app, what you saw, and the steps to repeat it. Please do not include real customer data, and do not publish the problem before we have had a chance to read it.

This is the same address as for support. For questions about personal data, use privacy@accounts.datadelight.co. We make no promise of a response time, and we do not run a bug bounty.

What every Atlassian app here has in common

• Each app runs on Atlassian's Forge platform. Atlassian hosts it and Jira or Confluence calls it.
• No app sends data to a server of ours or to any third party. None declares an external endpoint in its manifest.
• Each app asks for the permissions (scopes) listed below, and no others. A site administrator sees them when installing.
• The apps write troubleshooting lines to Atlassian's Forge app logs; each app's privacy policy says what those lines hold.

Block Done While Blockers Open for Jira

• Scopes: read:jira-work
• Data stored: none. It has no storage of its own.
• More: privacy policy, terms.

JQL Function Pack for Jira

• Scopes: read:jira-work, read:board-scope:jira-software, read:sprint:jira-software, read:project:jira, read:app-data:jira, write:app-data:jira
• Data stored: nothing in Forge storage. Jira itself saves each function's answer, with the arguments typed, in your Jira site.
• More: privacy policy, terms.

Bulk Change Issue Links for Jira

• Scopes: read:jira-work, write:jira-work, storage:app
• Data stored: a record of each run, kept in the app's Forge storage. The privacy policy lists what it holds and how long it is kept.
• More: privacy policy, terms.

Group Mentions for Confluence

• Scopes: read:confluence-groups, read:page:confluence, write:comment:confluence, read:confluence-content.summary, write:confluence-content, read:space:confluence, search:confluence, storage:app
• Data stored: records of group mentions and group subscriptions, kept in the app's Forge storage. The privacy policy lists them.
• More: privacy policy, terms.

Long URL Field for Jira

• Scopes: read:jira-work, write:app-data:jira
• Data stored: nothing in Forge storage. Field values are stored by Jira in your Jira site.
• More: privacy policy, terms.

Whole Number Field for Jira

• Scopes: read:jira-work, write:app-data:jira, read:field:jira, read:custom-field-contextual-configuration:jira
• Data stored: none of its own. Field values and field context settings are stored by Jira in your Jira site.
• More: privacy policy, terms.