Bespoke Jira Charts & Reports for Confluence — Security Information
This document describes the security posture of Bespoke Jira Charts & Reports for Confluence, the Atlassian Marketplace app. It is intended for security reviewers at customer organisations evaluating Bespoke for installation.
Platform
Bespoke is built entirely on Atlassian Forge, Atlassian's hosted application platform. Bespoke operates no third-party servers and runs no code outside Atlassian's network. No End-User Data is transmitted outside Atlassian's infrastructure.
What this means in practice
- Every function call executes in Atlassian's sandboxed Node 24 runtime
- The app declares no Forge storage modules — there is no Key Value Store usage to secure
- Every outbound network call is whitelisted in the Forge manifest and proxied through Atlassian
- The app cannot run code on your servers or your users' machines
Permissions
Bespoke requests two read-only Atlassian scopes:
| Scope | Reason |
|---|---|
read:jira-work | Run the chart's JQL search or resolve its saved filter, and read the work-item field values needed to group and count results |
read:jira-user | Resolve display names for user-type fields (e.g. Assignee) shown as chart group labels |
That is the complete scope list. The app requests no write scopes, no administrative scopes, no storage scopes, no outbound network scopes, and no Confluence content-write scopes.
The app does not request external network egress. No host appears in permissions.external.fetch because the app never calls any external host.
Authentication
The app uses one authentication pattern for every Jira read: it acts on behalf of the person viewing the page, never on its own authority.
Reads on behalf of the viewer (chart data + builder)
When a chart is rendered — or its configuration panel is open in the editor — the app reads Jira data on behalf of the signed-in viewer, so Atlassian's identity platform authorises every read against that viewer's own Jira permissions. If the viewer cannot see a work item, it is never counted or shown in their chart — the app cannot read anything the viewer themselves cannot read.
There are no other authentication paths. The app never acts with its own, app-level authority, does not consume customer-supplied API keys, and does not store any credentials anywhere.
Secret handling
None. Bespoke stores no secrets, no API keys, no OAuth tokens, no client credentials, and no encryption keys. The app has no Forge storage usage of any kind and no settings panel to enter credentials.
There is nothing to rotate, revoke, or audit on the secrets side — because there are no secrets.
Account actions
None. Bespoke never writes to any Jira account, work item, group, or storage. It has no write scopes (see Permissions). It cannot create, edit, delete, or transition any Jira work item, and cannot modify any Confluence content beyond the chart macro's own configuration, which is written only when the editor themselves clicks Save in the config panel.
The app's interaction with the Atlassian platform is exhaustively:
- Receive an invocation when a chart macro is rendered or its config panel opens
- Resolve the chart's JQL (directly, or via a saved filter lookup) as the viewer
- Fetch matching work items and the fields needed to group them, as the viewer
- Aggregate counts in memory
- Return the aggregated result to the chart UI
There is no sixth step. There is no audit log because there is no write action to audit.
Aggregation logic and zero-egress guarantees
All grouping and counting logic is performed by pure TypeScript functions in lib/ running inside the Forge sandbox. These functions:
- Have no Forge API calls inside them (enforced by code review and TDD)
- Have no network calls of any kind
- Have no I/O other than receiving work-item field values and returning grouped counts
The lib/ functions are unit-tested with Vitest. All communication with Jira is isolated to a single, thin layer that does nothing but fetch data and hand it to those functions. There is no AI, no analytics, no telemetry, no error reporting service, and no third-party SDKs of any kind embedded in this app.
Vulnerability reporting
Security vulnerabilities can be reported to security@taskhooker.com. We commit to acknowledging reports within 5 business days and disclosing patches via the Marketplace "What's new" section.
Compliance
Bespoke inherits the security and compliance posture of the underlying Atlassian Forge platform. Atlassian Forge is certified under:
- SOC 2 Type II
- ISO 27001 / 27017 / 27018
- PCI-DSS (for the platform itself; Bespoke does not handle payment data)
- GDPR and CCPA compliance commitments
Bespoke itself does not have independent certifications. The app code is reviewed by Atlassian as part of the Marketplace listing approval process.
Audit & change history
For your records, every code change to Bespoke is reflected in the What's new section of the Marketplace listing for each version. The Marketplace partner portal also exposes a full version history for compliance audits.