Security

Summary

The app is built so that there is as little to attack as possible. It is an Atlassian Forge app that consists only of a page shown inside Jira. It has no server of its own, keeps no data outside the user's browser, and has no permission to contact anything outside Atlassian. Issues are read and Word documents are made in the user's browser with that user's own Jira permissions, and never reach GRAMSHIFT.

Architecture

Data handling

• The app reads the issues the user chooses to export (their fields, description, comments, attachment list and custom fields), the pictures that go into the document, custom field names, the names of the saved filters the user can see, and the Word files attached to issues labelled word-template.
• This data is held in browser memory only while the page is open. The Word document (or a ZIP of several) is made in the same browser and handed to the browser as a download.
• Nothing is sent to GRAMSHIFT or to any third party. Uploaded templates stay in the user's own browser; there is no customer data at rest on our side.

Access control

• The app requests one Jira permission only: read:jira-work. It cannot create, change or delete anything in Jira.
• Every Jira request is made from the page with the signed-in user's own permissions. The app never acts with app-level permissions, so it can only see the issues, comments and attachments that user can already see in Jira. Issues and pictures the user may not open are listed as not included.
• Shared templates are ordinary Jira attachments, so who can see them is decided by your Jira permissions.
• The app does not ask for, collect or store passwords, API tokens or any other credentials.

Encryption

• In transit: the only network traffic is between the user's browser and Atlassian, over HTTPS (TLS), provided by Atlassian.
• At rest: the app stores nothing on our side. Uploaded templates are kept by the user's browser under that browser's own protection; Jira data stays in your Atlassian site under Atlassian's own protection.

Secure development

• Templates are filled in, never run: a tag such as ${Summary} is replaced by the field's value as text. A template cannot run code, and the app page does not allow running code made from text.
• A file is used as a template only if it opens as a Word document (.docx); other files are refused with a message. Uploaded templates are limited to 20 MB.
• The search is sent to the Jira REST API as request data; Jira parses and validates the JQL under the user's permissions.
• Text from Jira is written to the page as plain text, never as HTML, so issue content cannot inject scripts into the app. Characters that are not allowed in a Word document are removed before the text is written into it.
• File names are cleaned before use: path separators and characters that Windows or macOS do not allow are replaced, so a name cannot place a file outside its folder when a ZIP is extracted. Windows reserved names are prefixed, and each name is kept within 240 bytes.
• Pictures larger than 50 MB are not downloaded, and the total size of pictures in one file is limited (300 MB at first), so a large export is split instead of exhausting the browser's memory.
• The app contains no secrets (no API keys or tokens).
• Releases are tested end to end on our own Jira Cloud test site, including a check that the app page reports no content security policy violations or page errors.

Vulnerability management

• Third-party libraries are scanned for known vulnerabilities with npm audit, and fixes are released as new app versions.
• We follow the Atlassian Marketplace Security Bug Fix Policy for cloud apps: critical issues are fixed within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
• To report a vulnerability, email contact@gramshift.com. We aim to reply within 72 hours (Monday to Friday, 9:00–18:00 Japan time). Please do not include customer data in the report.

Security incidents

If we become aware of a security incident affecting the app, we notify Atlassian within 24 hours through the Marketplace partner security incident process, and we inform affected customers where their data is involved, following Atlassian's security incident guidelines for Marketplace partners.

Certifications and programs

GRAMSHIFT is a small business and does not hold security certifications such as SOC 2 or ISO 27001, and the app is not currently part of the Marketplace Security Bug Bounty Program. The app runs entirely on Atlassian's Forge platform; see Atlassian's own trust and compliance documentation for the platform.

Related documents

Privacy Policy · How to use the app

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan

日本語（要約）

本アプリは Atlassian Forge 上で動く、Jira の中の1画面だけのアプリです。自社のサーバー・Atlassian 側の保存領域・外部への通信を持ちません。課題は、使っている人のブラウザの中で、その人自身の Jira の権限で読み取り、Word 文書もそのブラウザの中で作るため、GRAMSHIFT にも第三者にも送られません。要求する権限は read:jira-work（読み取り）だけです。アップロードしたひな形はその人のブラウザの中にだけ保存し、アプリから消せます。ひな形は「差し込む」だけで、中に書かれた物を動かすことはありません。ファイル名は、展開したときにフォルダーの外へ出ないよう区切り文字などを置き換えます。通信は利用者のブラウザと Atlassian の間の HTTPS だけです。利用している部品は npm audit で確認し、脆弱性は Atlassian Marketplace の修正期限（重大は10日以内など）に従って直します。脆弱性の報告は contact@gramshift.com へ。SOC 2・ISO 27001 などの認証は取得していません。