Security

Architecture

• Built on Atlassian Forge. Code runs on Atlassian's infrastructure; there are no servers of ours.
• The app has no storage of its own: no Forge storage, no database. Files are ordinary Jira attachments and a field's value (a list of attachment IDs) is kept in the Jira issue.
• No egress: the app declares no external domains and makes no calls outside Atlassian. It is eligible for Atlassian's "Runs on Atlassian" program.

Access control

• Adding files, listing them and downloading them run as the signed-in user, so Jira's issue and attachment permissions decide who can see or add files. An attachment the user can't read shows as "unavailable".
• The only call made with the app's own permission reads the field's limit settings (allowed types, size, count) for the issue the field is shown on. It returns only those settings, never issue or attachment data.
• The issue and field are taken from Forge's trusted invocation context, not from the browser.

Data handling

• The field value is parsed so that only numeric attachment IDs are kept.
• File names are shown with React and Forge UI Kit escaping. Custom UI uses no inline scripts or styles.
• Removing a file from a field never deletes the Jira attachment.

Permissions (scopes)

Reporting a vulnerability

Email support@bobob.app with "Security" in the subject. We acknowledge within 72 hours and fix critical issues as a priority.