Security

Summary

The app is built so that there is as little to attack as possible. It is an Atlassian Forge app that consists only of a page shown inside Jira. It has no server of its own, stores nothing, and makes no network requests outside Atlassian. The Excel file is read in the user's browser, and issues are created or updated with that user's own Jira permissions. Neither the file nor Jira data ever reaches GRAMSHIFT.

Architecture

Data handling

• The .xlsx file the user selects is parsed in the user's browser. The file itself is never uploaded anywhere; only the field values of the rows being imported are sent to the user's own Jira site through the Jira REST API.
• The app reads the Jira projects, issue types, fields and users it needs to match the columns of the file, and the existing issues that are to be updated.
• The data is held in browser memory only while the page is open. Nothing is sent to GRAMSHIFT or to any third party, and nothing is stored by the app. There is therefore no customer data at rest on our side and nothing to delete when the app is uninstalled.

Access control

• The app requests three Jira permissions: read:jira-work (read projects, fields and issues), write:jira-work (create and update issues) and read:jira-user (turn assignee and reporter names into Jira accounts).
• Every Jira request is made from the page with the signed-in user's own permissions. The app never acts with app-level permissions, so it cannot create or edit issues that the user could not create or edit in Jira.
• The app only creates and updates issues. It does not delete issues.
• The app does not ask for, collect or store passwords, API tokens or any other credentials.

Encryption

• In transit: the only network traffic is between the user's browser and Atlassian, over HTTPS (TLS), provided by Atlassian.
• At rest: the app stores no data, so there is no app data to encrypt at rest. Jira data stays in your Atlassian site under Atlassian's own protection.

Secure development

• Every row is validated before anything is written: dates and date-times must be real calendar values, numbers must parse as numbers, user names must resolve to a Jira account, and required fields must be present. Rows that fail are not sent and are listed with the reason.
• Before anything is written, a check step shows how many issues will be created or updated, how each column maps to a Jira field, and the rows that will not be sent, with the reason for each (the first 200 on screen, all of them in a downloadable check file). Nothing is written to Jira until the user presses the Import button. Jira itself can still reject a row when it is written; such rows are reported as failed.
• Values are sent to Jira as JSON, and issue and project keys used in request addresses are URL-encoded.
• Text from the file and from Jira is written to the page as plain text, never as HTML, so it cannot inject scripts into the app. Cells in the check and result workbooks are written as plain values (text and row numbers), never as formulas.
• The app contains no secrets (no API keys or tokens).
• Releases are tested end to end on our own Jira Cloud test site, including a check that the app page makes no network requests outside Atlassian.

Vulnerability management

• Third-party libraries are scanned for known vulnerabilities with npm audit, and fixes are released as new app versions.
• We follow the Atlassian Marketplace Security Bug Fix Policy for cloud apps: critical issues are fixed within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
• To report a vulnerability, email contact@gramshift.com. We aim to reply within 3 business days (Monday to Friday, Japan time). Please do not include customer data in the report.

Security incidents

If we become aware of a security incident affecting the app, we notify Atlassian within 24 hours through the Marketplace partner security incident process, and we inform affected customers where their data is involved, following Atlassian's security incident guidelines for Marketplace partners.

Certifications and programs

GRAMSHIFT is a small business and does not hold security certifications such as SOC 2 or ISO 27001, and the app is not currently part of the Marketplace Security Bug Bounty Program. The app runs entirely on Atlassian's Forge platform; see Atlassian's own trust and compliance documentation for the platform.

Related documents

Privacy Policy · How to use the app

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan

日本語（要約）

本アプリは Atlassian Forge 上で動く、Jira の中の1画面だけのアプリです。自社のサーバー・保存領域・外部への通信を持ちません。Excel ファイルは使っている人のブラウザの中で読み取り、ファイルそのものはどこにも送りません。課題の作成・更新は、その人自身の Jira の権限で行います。要求する権限は read:jira-work・write:jira-work・read:jira-user の3つで、課題の削除はしません。書き込む前に全行を検証し、利用者が「取り込む」を押すまで何も書き込みません。利用している部品は npm audit で確認し、脆弱性は Atlassian Marketplace の修正期限（重大は10日以内など）に従って直します。脆弱性の報告は contact@gramshift.com へ。SOC 2・ISO 27001 などの認証は取得していません。