Quietstack

Security Policy

Applies to all Quietstack apps, including Sentry Bridge for Jira · last updated July 2026

This page explains how we secure our apps and what we do when something goes wrong. It's written plainly rather than in certification language, because we'd rather you know exactly what is and isn't in place.

Reporting a security issue

Email security@quietstack.app. Please include what you found, how to reproduce it, and the impact you think it has.

We don't run a paid bug bounty, and we won't take legal action against anyone who reports a genuine issue in good faith without accessing other people's data.

How the apps are built — the security that comes from architecture

Our apps are Atlassian Forge apps. That's a deliberate security decision, not just a technical one, and it removes whole categories of risk:

• No servers of ours. The app runs inside Atlassian's infrastructure. There is no Quietstack server, database, or network for an attacker to reach.
• No egress. Sentry Bridge declares no external.fetch permission, so it makes zero outbound network calls. You can verify this on the permission screen before you install.
• Data stays in your tenant. The app stores only your settings and a mapping of Sentry issue → Jira issue, in Atlassian's storage inside your own site. Nothing is copied to us.
• No telemetry, no analytics, no third parties. We have no sub-processors, because no data ever leaves Atlassian.
• Least privilege. The app requests only the scopes it needs: read/write Jira work items, read Jira users, and app storage.

Application security controls

Area	What we do
Authentication of inbound webhooks	The webhook endpoint can be locked with a shared secret you choose; requests without it are rejected with 401.
Injection resistance	Issue types and statuses are addressed by id rather than by free-text name. Issue content is built as structured ADF, not concatenated markup. Malformed payloads are rejected with 400.
Secrets	The app collects no Atlassian passwords or API tokens, and no third-party credentials. Nothing sensitive is hard-coded; Forge handles authentication to Jira.
Logging	We never log credentials, tokens, or personal data. Logs cover app events and errors only, and stay within Atlassian's platform logging.
Dependencies	Kept minimal (essentially the Forge SDK) and scanned with npm audit. Static checks run via forge lint on every deploy.
Access to our own accounts	Multi-factor authentication is enabled on the accounts used for development, source control, and Marketplace administration. Development machines use full-disk encryption and automatic OS updates.

Vulnerability management

We check dependencies for known vulnerabilities with automated tooling and keep them current. When a vulnerability is found — by us, by a researcher, or by Atlassian — we triage it by severity and aim to fix in line with Atlassian's Marketplace security bug fix policy:

Severity	Target fix time
Critical	Within 2 weeks
High	Within 4 weeks
Medium / Low	Within 6 weeks

Because the apps run on Forge, we don't patch operating systems or servers — Atlassian maintains the runtime. Our patching responsibility is our own code and its dependencies.

Security incidents

If we confirm a security incident affecting an app or its customers, we:

1. Contain it first — if needed, we ship a fix or disable the affected functionality.
2. Work out what happened and what data, if any, was involved.
3. Notify affected customers and Atlassian, following Atlassian's security incident management guidelines and using their notification templates.
4. Fix the root cause and write down what changed so it doesn't recur.

Our security contact is registered with Atlassian's vulnerability management system, so their security team can reach us directly.

What we don't have — stated plainly

Quietstack is a small independent developer. We think it's more useful to be clear about the limits than to imply enterprise processes we don't run:

• No SOC 2, ISO 27001, PCI, or HIPAA certification.
• No third-party penetration test or external security audit.
• No paid bug bounty programme.
• No 24/7 on-call rotation — we answer within one business day.

What offsets this is the architecture: the apps hold no data outside your own Atlassian tenant and make no outbound calls, so the surface those programmes normally protect largely doesn't exist here.

Changes to this policy

Material changes will be published on this page with a new date.

Contact

Security — security@quietstack.app
Support — support@quietstack.app
Privacy — see our Privacy Policy