Security

Last updated: 18 September 2026

Statuswatch is a Forge app for Jira. This page describes how it is secured, what it can and cannot reach, and how to report a problem.

Reporting a vulnerability#

Write to support@status-watch.io. Mail to that address reaches the developer directly, not a queue. Please include enough detail to reproduce the issue. Reports are acknowledged and, where a fix is needed, the fix is deployed and the reporter told what changed.

Please do not test against other people's Jira sites. If you need an instance to demonstrate a problem, say so and one will be provided.

Where the app runs#

Entirely on Atlassian's Forge platform. The app has no server, no database and no infrastructure operated by the developer. There is nothing to breach outside Atlassian, because nothing exists outside Atlassian.

Egress#

None. The app makes no requests to any host outside Atlassian — no analytics, no error tracking, no content delivery network, no third-party service of any kind. This is enforced by the platform: the manifest declares no external permissions, and every deployment is checked against Atlassian's Runs on Atlassian criteria, which a single outbound request would forfeit.

Permissions and access#

The app requests two scopes: read:jira-work to read the work item and its status history, and storage:app to keep one configuration record per project. It requests no write scope and cannot modify a work item.

Every call to Jira is made as the signed-in user, never as the app itself. Statuswatch can therefore only ever read what that person was already permitted to read; the platform enforces this rather than the app. A viewer without permission on a project receives a 404 from Jira, which the app treats as a denial.

Changing a project's working hours is guarded in the resolver, not only in the interface. The check asks Jira for the caller's permissions and refuses if the answer is anything other than a clear yes — including when the permission call itself fails. Hiding a button is not a control; the write path is checked on every call.

What is stored#

One record per project, in Atlassian's Forge storage on the customer's own site: working days, start and end times, an optional break, holiday lines and a time zone. It contains no names, no account identifiers and no work item content. Durations shown on a work item are recalculated on every open and are never stored.

Secrets#

The app asks users for no credentials of any kind — no API tokens, no personal access tokens, no passwords, no shared secrets. It holds no keys, because it has no external service to authenticate against.

Logging#

On a failed read the app writes a diagnostic line to Forge's own logs containing the work item or project key and the error message. No work item content, user names or account identifiers are logged, and the logs remain inside Atlassian.

Dependencies#

The runtime dependencies are Atlassian's own Forge packages and React. The app carries no third-party analytics, tracking or telemetry libraries.

Changes to this policy#

Material changes will be reflected on this page, along with an updated date at the top.