Security
Reporting a vulnerability
Email security@bluevariation.com with a description, steps to reproduce and the affected app. We acknowledge reports within two business days and follow Atlassian's Security Bug Fix Policy timelines for fixes. Please give us a reasonable time to fix before public disclosure. We do not pursue legal action against good-faith research.
How the apps are built
- Runs on Atlassian. Both apps execute only on Atlassian's Forge platform. There are no external servers, no egress to third-party services, and no external scripts or images.
- Least privilege. Time in Status Lite requests
read:jira-workandstorage:apponly, and reads Jira as the signed-in user so nobody sees issues they cannot already see. Numbered Headings Lite requests no scopes at all. - Minimal storage. Time in Status Lite stores per-project settings in Forge hosted storage, encrypted at rest, in the same region as your Jira data. Numbered Headings Lite stores nothing.
- Dependencies are pinned and reviewed on each release; the apps pass Atlassian's Ecoscanner checks on every deployment.
Contact
security@bluevariation.com for security matters, support for everything else.