Atlassian documentation

Ensure that every request made to the application is sufficiently authorized.

Your responsibilities

• You must use asUser() whenever you are performing an operation on behalf of a user. This ensures your app has at most the permissions of the calling user.

• Before making calls asApp(), you must verify expected permissions (for example, from product context) with the permissions REST APIs before making the request.

Atlassian's responsibilities

• Obtain user consent for asUser() calls before invoking your Forge application.

• Ensure that only users with access to the site can interact with apps.

Atlassian documentation

Ensure that data is appropriately stored and read by your app.

Your responsibilities

• Ensure that sensitive security data, such as pre-shared keys, API keys, or encryption keys are not hardcoded in the source code. Secure storage, such as encrypted environment variables, should be used to supply keys at runtime.

• Ensure that keys are rotated on a regular basis. You should rotate sensitive API keys at least every 90 days.

• Ensure that authorisation controls exist to segregate data access between different user roles within the same tenant.

Atlassian's responsibilities

• Encrypt data at rest for data stored within Forge app storage.

• Segregate data storage to prevent cross-tenant access. This includes Forge app storage.

Atlassian documentation

Apply secure software development practices when building and maintaining your app.

Your responsibilities

• Periodically scan for vulnerabilities in third-party dependencies using tools, such as OWASP Dependency-Check or other similar tools.

• Perform regular threat modeling to identify and prioritize threats that may impact the security of your app.

• Perform static analysis of your app to identify patterns of insecure code.

Atlassian documentation

Your responsibilities

• Ensure your application does not log personally identifiable information (PII), authentication tokens, and user-generated content (UGC), or confidential data.

Atlassian's responsibilities

• Maintain robust logging that includes an audit trail of actions performed by an app.

• Restrict access to logs based on organization permissions.

Atlassian documentation

Your responsibilities

• Mitigate application security vulnerabilities within the set timelines.

• Promptly notify Atlassian of security vulnerabilities discovered in your app in accordance with the Marketplace partner agreement.

Atlassian's responsibilities

• Disable applications that haven't mitigated vulnerabilities within the set timelines.

• Mitigate security vulnerabilities in the platform within the Security bug fix policy.

• Communicate with Marketplace partners about vulnerabilities in the platform or applications that may affect their apps.

Atlassian documentation

Your responsibilities

• Establish a security incident response plan , so you are better prepared to respond to security breaches and incidents.

• Promptly notify Atlassian upon discovery of any security incident in accordance with the Atlassian developer terms.

• Keep developer account contact information up to date for security incidents.

Atlassian's responsibilities

• Maintain a security incident response plan that includes the ability to detect and respond to apps.

• Identify, detect, and respond to security incidents.