Security

Last updated: 21 September 2026

Statuswatch is a Forge app for Jira. This page describes how it is secured, what it can and cannot reach, and how to report a problem.

Reporting a vulnerability#

Write to support@status-watch.io. Mail to that address reaches the developer directly, not a queue. Please include enough detail to reproduce the issue. Reports are acknowledged and, where a fix is needed, the fix is deployed and the reporter told what changed.

Please do not test against other people's Jira sites. If you need an instance to demonstrate a problem, say so and one will be provided.

Where the app runs#

Entirely on Atlassian's Forge platform. The app has no server, no database and no infrastructure operated by the developer. There is nothing to breach outside Atlassian, because nothing exists outside Atlassian.

Egress#

None. The app makes no requests to any host outside Atlassian: no analytics, no error tracking, no content delivery network, no third-party service of any kind. This is enforced by the platform: the manifest declares no external permissions, and every deployment is checked against Atlassian's Runs on Atlassian criteria, which a single outbound request would forfeit.

Permissions and access#

In Jira the app requests three scopes: read:jira-work to read the work item and its status history, storage:app to keep one configuration record per project, and send:notification:jira to have Jira email a work item's assignee when an alert a project administrator set up is due. The last was chosen over a write scope because it can ask Jira to notify people and cannot change a work item. It requests no write scope. The only thing it can set on a work item is the value of its own read-only report fields; doing so leaves no history entry and does not change the item's Updated date. For Confluence it holds five more, all of them read-only: read:confluence-content.summary, read:confluence-content.all, read:confluence-space.summary, search:confluence and read:space:confluence. It writes nothing to Confluence.

Every call made for someone looking at a screen (the panel, the settings page, the export, the Rovo agent) is made as that person, never as the app itself. There, Statuswatch can only ever read what that person was already permitted to read; the platform enforces this rather than the app. A step in a Jira Automation rule reads as the person who connected it.

One part reads as the app: the hourly run behind the report fields and the alerts, and only in projects whose administrator has switched one of them on. They are refreshed every hour with nobody signed in, and Jira asks for a field's value without naming a viewer, so there is no person to read as. The app then reads the status history of the project's open work items and writes one number and one date back to its own fields. A field's value is visible exactly where its work item is, so this shows nobody anything they could not already open. A viewer without permission on a project receives a 404 from Jira, which the app treats as a denial.

Changing a project's working hours is guarded in the resolver, not only in the interface. The check asks Jira for the caller's permissions and refuses if the answer is anything other than a clear yes, including when the permission call itself fails. Hiding a button is not a control; the write path is checked on every call.

What is stored#

One record per project, in Atlassian's Forge storage on the customer's own site: working days, start and end times, an optional break, holiday lines and a time zone. It contains no names, no account identifiers and no work item content. Durations shown on a work item are recalculated on every open and are never stored.

Secrets#

The app asks users for no credentials of any kind: no API tokens, no personal access tokens, no passwords, no shared secrets. It holds no keys, because it has no external service to authenticate against.

Logging#

On a failed read the app writes a diagnostic line to Forge's own logs containing the work item or project key and the error message. No work item content, user names or account identifiers are logged, and the logs remain inside Atlassian.

Dependencies#

The runtime dependencies are Atlassian's own Forge packages and React. The app carries no third-party analytics, tracking or telemetry libraries.

Changes to this policy#

Material changes will be reflected on this page, along with an updated date at the top.