Vulnerability Disclosure Policy

Effective October 28, 2026

How to report

Write to info@plugincraft.ca. For an urgent matter, such as data being exposed now, put "URGENT" at the start of the subject line. Security contact hours: 8:00 to 17:00 Eastern Time, Monday to Friday. The same contact is in our security.txt file.

Please include:

• what you found, which part of TreeCraft it affects, and why you think it is a security problem;
• the steps to reproduce it, with any request, screenshot or proof of concept that helps;
• the version of the app and the kind of Jira site you tested on;
• your estimate of the impact, and a CVSS score if you have one;
• how you would like to be credited, if at all.

Do not put real customer data in your report. If you came across some, tell us, stop testing and delete it.

What is in scope

• TreeCraft: Issue Hierarchies for Jira Cloud (the Forge app ID is at the top of this page): its pages, Forge functions, REST API, MCP tools and Rovo agent actions.
• How the app stores, reads and shows data, including how it applies Jira's permissions and its own access levels.
• The pages of this website, plugincraft.ca. They are static, so we expect few findings there.

What is out of scope

• Jira, Forge, Rovo, the Atlassian Marketplace and other Atlassian services. Report those to Atlassian (see below).
• Other customers' Jira sites, and any site you do not own or do not have permission to test.
• Denial of service, load or volume testing, and automated scanning that generates heavy traffic. It can affect other customers.
• Social engineering, phishing and physical attacks against Plugincraft or its providers.
• Reports from automated tools with no demonstrated impact, missing security headers with no exploit, and findings that need an already compromised device or account.

Documented behaviour that is not a vulnerability

These behaviours are described in our trust documents and are design decisions. Please do not report them as new findings:

• The app keeps each hierarchy's structure as work item ids and positions. A person who can open a hierarchy can receive the ids of work items they cannot browse. Work item keys, summaries and field values are never included.
• Live update hints hold a hierarchy id, a time and at most 100 numeric work item ids, so a viewer may learn that a work item they cannot see has changed.
• When someone with Control turns on Jira search for a hierarchy, anyone who can search Jira can tell which of the work items they may browse are in it.

Anything beyond what these pages describe is in scope. For example, a work item key, summary or field value that reaches a person who cannot browse that work item is a serious finding.

Rules for testing

• Test only on a Jira site that you own or administer, with sample data.
• Use the least access and the fewest requests that show the problem. Do not read, change or delete data that is not yours.
• Stop as soon as you have shown the problem. Do not use a finding to look at more data, to move sideways or to keep access.
• Do not degrade the service for others.
• Do not share details before the disclosure terms below are met.

Safe harbour

We want researchers to report problems. If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take legal action against you, and we will not ask law enforcement to investigate you, for research done under this policy. If a third party takes legal action against you for research that followed this policy, we will say that it was authorized.

This policy covers Plugincraft only. It does not bind Atlassian or any other company, and it does not let you break their rules. If you test Atlassian's services or report through Atlassian's programs, follow their terms. If you are unsure whether something is allowed, ask us first at info@plugincraft.ca.

What to expect from us

These are the deadlines of Atlassian's Security Bug Fix Policy for cloud apps, which we checked on October 27, 2026. Atlassian allows an extension only in limited cases, for example when the fix depends on a change to the Atlassian platform. If we ever need one, we tell you. Business days are Monday to Friday, and business hours are 8:00 to 17:00 Eastern Time. We respond to a vulnerability alert from Atlassian within 8 business hours.

Disclosure and credit

We follow coordinated disclosure. Please keep the details private until we release a fix, or until 90 days after your report, whichever comes first. If the fix deadline for a Low finding is longer than that, we agree a date with you. If we publish an advisory, we credit you by the name you prefer, unless you want to stay anonymous. Plugincraft does not pay rewards for reports yet. See Security practices for our plans.

Reporting through Atlassian

Atlassian's Vulnerability Disclosure Program lets researchers report a vulnerability in a Marketplace app through the Marketplace Security Bug Bounty program. Once TreeCraft is listed on the Atlassian Marketplace, you can use that route as well. Report vulnerabilities in Jira, Forge or other Atlassian products to Atlassian.

Related documents

• Security overview
• Incident Response
• Data Logging
• Privacy policy