Security

Our apps are built to keep your content where it already is: in your Atlassian site.

How the apps are built

• Runs on Atlassian. The apps use only Atlassian-hosted compute. They make no requests to servers outside Atlassian, and Atlassian enforces this for Runs on Atlassian apps.
• No app storage. The apps store nothing of their own. What you paste lives in the Confluence page; files live in the page's attachments.
• Least privilege. Each app asks only for the permissions it needs. Both current apps can read attachments and nothing else.
• As the viewing user. Requests to Confluence run as the person viewing the page, so nobody sees an attachment they could not already open.
• No content in logs. Error logs contain error codes and HTTP status numbers only.
• Sanitized rendering. HTML inside Markdown is sanitized (scripts, event handlers, frames and forms are removed), and every page runs under Atlassian's strict content security policy.
• Dependencies are checked for known vulnerabilities before every release.

Report a vulnerability

Email security@golden-dorado.com with a description and steps to reproduce. We acknowledge reports within 24 hours and fix confirmed issues within Atlassian's deadlines (critical: 10 days, high: 4 weeks). Please give us a reasonable time to fix an issue before publishing it. We do not run a paid bug bounty.

Incidents

If we learn of a security incident affecting customer data, we notify Atlassian within 48 hours and affected customers as quickly as we can.