Security
DashKeep for Jira is a Forge app with two dashboard gadgets (Note and Count). This page describes security practices. The privacy policy is a separate document: privacy.html.
Architecture
The app runs on Atlassian Forge (Runs on Atlassian). There are no Forge remotes, no vendor-owned
backends, and no egress of End-User Data to vendor servers or third-party subprocessors.
Count calls Jira as the viewing user via forgeApi.asUser().requestJira.
The app does not use asApp(), web triggers, or personal access tokens.
Data handling
- Note text, optional caption, refresh interval, and Count JQL are stored as Jira dashboard gadget configuration.
- Count requests an approximate work-item total for that JQL. The gadget displays a number, not issue summaries.
- Clicking the count opens Jira’s issue navigator with the same query.
- There is no vendor database. After uninstall we retain no copy of gadget configuration.
Access control
The only declared scope is read:jira-work, used to count work items the viewer can already see.
Jira session and site permissions apply. There is no separate DashKeep login.
Input handling
Note body is capped at 8000 characters. JQL is trimmed, HTML-decoded, and capped at 2000 characters. The note is shown as text. Count sends that JQL to Jira as the viewing user; Jira parses it.
Encryption
Data in transit and at rest is handled by Atlassian Cloud / Forge. We do not store End-User Data on vendor machines, so there is no separate vendor datastore to encrypt.
Logging
We do not write End-User Data (note text, JQL, issue contents) to vendor logs. Forge platform logs are processed by Atlassian.
Vulnerability management
Production dependencies are reviewed with npm audit --omit=dev before Marketplace versions.
We do not run a public bug-bounty program and we do not claim SOC 2, ISO 27001, or similar certifications.
Report a vulnerability
Email support@vovaluka.com with SECURITY in the subject. Do not attach secrets or customer data in a public Marketplace review.