Security

Security contact: aclstudiohq@gmail.com (subject line "SECURITY")

Architecture

• Quadmira is built on Atlassian Forge and is eligible for Runs on Atlassian: it runs entirely on Atlassian's infrastructure.
• No external calls. The app declares no outbound network access (no external fetch, scripts, fonts, images or frames) and has no servers of its own.
• No AI. The app has no AI or machine-learning features and sends no data to AI services.
• Data stays in your site. RACI values are stored in a Jira issue property on each work item; team labels and templates are stored in Atlassian-hosted Forge storage.

Data minimisation

• The app stores no personal data: assignees are references to project roles and admin-defined team labels only, never account IDs, names or emails.
• Team label names that look like email addresses or phone numbers are rejected.
• Logs contain only HTTP status codes and error types, never request or response bodies, work-item content or user identifiers.

Access control

• Work-item reads and writes run as the current user, so Jira enforces their Browse and Edit permissions.
• Settings, templates and data removal require Administer Projects for that project, or Jira administrator permission. This is checked on the server for every request.
• Project and work-item IDs come only from Atlassian's trusted context, never from the browser.
• Matrix filters are always limited to the current project.
• CSV exports are protected against spreadsheet formula injection.

Minimal permissions

read:jira-work, write:jira-work (work-item properties only) and storage:app. No user, group, admin or offline scopes.

Vulnerability handling

We follow Atlassian's Marketplace Security Bug Fix Policy:

Please report issues privately to the security contact and give us reasonable time to fix them before public disclosure. We will confirm receipt, keep you updated and credit you if you wish. We review dependencies for known vulnerabilities on every release.

Last updated: 24 October 2026