Security Practices
Worklog Rollup for Jira is designed as an Atlassian Forge app for Jira Cloud, with a narrow data scope focused on Jira logged-time rollups.
Jira Cloud and Atlassian Forge. No Jira Data Center, Connect or separate vendor-hosted product backend is used.
read:jira-work and storage:app.
Issue hierarchy and Jira time tracking fields needed for calculation.
Architecture
The app renders a Jira issue panel and calls Forge backend code to retrieve issue data through Jira APIs. It reads the current issue context, descendant issue relationships and Jira time tracking values needed to calculate totals.
Atlassian Forge security posture
Atlassian describes Forge as a serverless app development platform where compute and storage can be hosted on Atlassian infrastructure. The app is designed to use this Forge model and not send worklog data to a separate vendor backend.
Permissions
read:jira-work is used to read issue and time tracking data. storage:app is used for app-scoped calculation cache. Jira permissions continue to control which issue data a user can access in Jira.
Data storage
The app uses short-lived Forge Storage cache for calculation results. It does not store costs, rates, invoices or Tempo data.
Logging
The app should avoid logging sensitive issue content. Technical logs should focus on operational status and error diagnosis.
Vulnerability reporting
Security issues can be reported to Mederak Apps Service Desk. Please include reproduction steps, impact, affected tenant context and screenshots where appropriate.
Atlassian Marketplace alignment
The app is prepared with Marketplace security expectations in mind, including least-privilege thinking, privacy documentation, customer terms, support contact and transparency about data handling.