Incident Response

Effective October 28, 2026

Scope

This process covers incidents that affect TreeCraft: Issue Hierarchies. TreeCraft runs on Atlassian Forge, so it also depends on Jira Cloud and Forge. Problems with those platforms are Atlassian's to resolve and are reported on Atlassian's status page. We follow them and, where they affect the app, tell customers.

A security incident is any actual or suspected unauthorized access to customer data, a security compromise of the app, or, as Atlassian puts it, an issue that materially degrades Atlassian systems. An operational incident is any other event that makes the app unavailable, wrong or unusably slow.

Roles

Incident lead: the owner of Plugincraft Software inc., or the person the owner appoints. The lead owns the incident from detection to review, decides the severity, and is the single voice to customers and to Atlassian. Security contact: info@plugincraft.ca.

Business days and response commitments

Business days are Monday to Friday, and business hours are the support hours: 8:00 to 17:00 Eastern Time. A message that arrives outside business hours counts from the start of the next business period. These are the times Plugincraft commits to. They match the minimums that Atlassian sets for Marketplace partners in the Atlassian Enterprise Certified program, or improve on them.

Atlassian sends test notifications to check that partner contacts work. We answer them like real alerts. Our security contact is info@plugincraft.ca.

1. Detection

Incidents reach us through:

• customer reports, through the contact page and info@plugincraft.ca;
• vulnerability reports (see the Vulnerability Disclosure Policy) and, once the app is listed, those from Atlassian's Marketplace Security Bug Bounty program;
• notices from Atlassian about Forge, Jira or the Marketplace;
• the app's own logs, which record failures as ids, counts, statuses and error codes (see Data Logging), and the usage figures in Atlassian's developer console;
• advisories for the libraries the app uses, when we hear of them.

Every business day we review the app's logs and the error figures in Atlassian's developer console, and we read Atlassian's notices. The secret scan described in the Security overview runs automatically, and we act on what it finds. No automated dependency or static analysis scan runs yet; they are being added.

2. Triage and classification

The incident lead confirms the report, records the time it was received, and sets a severity within the first response time below. The severity is reviewed as facts come in.

Security vulnerabilities are also fixed within the deadlines of Atlassian's Security Bug Fix Policy: 10 days for Critical, 4 weeks for High, 12 weeks for Medium and 25 weeks for Low (see the Security overview). Where a vulnerability also has a severity here, we meet the shorter time. Resolution means the problem is fixed in a released version, or a workaround is in place and no harm continues. Critical support requests, meaning Severity 1 and Severity 2, get a first response within 24 hours, five business days a week. Support hours: 8:00 to 17:00 Eastern Time, Monday to Friday.

3. Containment and resolution

• Contain: limit the harm first. Depending on the incident, this can mean turning off the app's REST API and MCP tools (the switch an admin has, and that we can ask an admin to use), withdrawing a faulty version, or shipping a fixed one.
• Investigate: find the cause and the sites and data affected, using the app's logs. Because logs hold no customer content, we may ask an admin for a support bundle, which is the admin's choice.
• Fix: ship the fix as a new version of the app on Forge, and check it before closing the incident.
• Verify: confirm with the people who reported it, and watch the logs afterwards.

4. Communication

• Atlassian. For a security incident we notify Atlassian promptly, and no later than 24 hours after we learn of it, by raising a P1 ticket, and we update Atlassian at least every 6 hours until the incident is resolved. This follows Atlassian's app security incident management guidelines. Eligible Forge app partners can also work directly with Atlassian Security through its Partner Security Incident Response Program, and we use it when we are eligible.
• Customers. We tell the admins of affected sites by email to the technical contact that Atlassian gives Marketplace partners for each site, and, once it exists, with a notice on the status page. For a security incident we aim to do so within 72 hours of identifying it, using the incident communication template Atlassian recommends. Updates for a continuing incident: at least every 24 hours for Severity 1 and every 2 business days for Severity 2, until it is resolved.
• Privacy authorities. If a confidentiality incident involving personal information creates a risk of serious injury, we tell the people concerned and the Commission d'accès à l'information du Québec promptly, as the law requires, and we keep a register of every incident (see the privacy policy).
• Status. A status page will be published with the Marketplace listing. For an urgent security matter, put "URGENT" at the start of the subject line of your message.

5. Post-incident analysis

After every Severity 1 and Severity 2 incident, and after any security incident, the incident lead writes a review within 10 business days of the incident's resolution. It covers:

• a timeline from detection to resolution;
• the root cause, and the sites and data affected;
• what worked and what did not in detection, triage and communication;
• whether any sign of compromise remains;
• whether logging needs improvement;
• the actions to prevent a similar incident, with an owner and a date for each;
• changes to this process.

For a security incident we submit the findings through the original ticket with Atlassian. We share a summary with affected customers. We review this process at least once a year and after every Severity 1 incident.

Related documents

• Security overview
• Vulnerability Disclosure Policy
• Data Logging
• Data Handling: Retention and Deletion
• Privacy policy