Security
Report a security issue
If you believe you have found a vulnerability in Project Pulse, write to support@johna.app with "Security" in the subject. Please include the steps to reproduce it, and do not disclose it publicly before we have answered. We acknowledge every report and keep you informed until it is resolved.
How the app is built
- Runs on Atlassian. Project Pulse is built entirely on Atlassian Forge. Its code runs on Atlassian's infrastructure, and it is eligible for the Runs on Atlassian programme.
- No outbound network call. The app calls no external server, no third-party service and no CDN. Your data never leaves Atlassian.
- No secrets. The app holds no password, token or API key. Authentication is handled by Forge.
What the app can see
- Three permissions, all read-only except the app's own storage:
read:jira-work,read:confluence-content.permissionandstorage:app. The privacy policy explains each one. The app never writes to Jira or Confluence. - Minimal reads. To count issues, the app requests the status field only.
- Only counts reach the page. No issue key, summary, description or person's name is ever sent to the browser. This rule is enforced in a single place in the code and checked automatically before every release.
- Editing is checked on the server. Before anyone changes a view, the app checks with Confluence, on the server side, that they may edit the page.
Where the data lives
- All data is kept in Forge hosted storage, run by Atlassian and encrypted at rest.
- It follows the data residency of your Atlassian site: Atlassian stores it in the same location as your Confluence.
- The app stores no personal data. Details and retention periods are in the privacy policy.