Vulnerability Disclosure Policy

Effective [date of publication]

How to report

Write to info@plugincraft.ca. For an urgent matter, such as data being exposed now, put "URGENT" at the start of the subject line. Security contact hours: 8:00 to 17:00 Eastern Time, Monday to Friday. The same contact is in our security.txt file.

Please include:

• what you found, which part of TuneCraft it affects, and why you think it is a security problem;
• the steps to reproduce it, with any request, screenshot or proof of concept that helps;
• the version of the app and the kind of Jira site you tested on;
• your estimate of the impact, and a CVSS score if you have one;
• how you would like to be credited, if at all.

Do not put real customer data in your report. If you came across some, tell us, stop testing and delete it.

What is in scope

• TuneCraft: Automation & Site Cleanup for Jira Cloud (the Forge app ID is at the top of this page): its pages, Forge functions, the web trigger that receives the automatic scan, and the Rovo agent's actions.
• How the app stores, reads and shows data, including how it applies Jira's permissions and its own access levels.
• The pages of this website, plugincraft.ca. They are static, so we expect few findings there.

What is out of scope

• Jira, Forge, Rovo, the Atlassian Marketplace and other Atlassian services. Report those to Atlassian (see below).
• Other customers' Jira sites, and any site you do not own or do not have permission to test.
• Denial of service, load or volume testing, and automated scanning that generates heavy traffic. It can affect other customers.
• Social engineering, phishing and physical attacks against Plugincraft or its providers.
• Reports from automated tools with no demonstrated impact, missing security headers with no exploit, and findings that need an already compromised device or account.

Documented behaviour that is not a vulnerability

These behaviours are described in our trust documents and are design decisions. Please do not report them as new findings:

• The app keeps a keyed hash in place of many names and texts. A keyed hash is a pseudonym, not a secret from whoever holds the database: the key is kept in the same storage, so a short name can be found again by trying candidates.
• The automatic scan's key holds the site's scan key beside the secret that the web trigger checks, because the sender needs the scan key to make the same keyed hashes as the browser. Whoever holds the whole key can push scans to the app and test guesses against a keyed hash. Replacing the key stops the secret at once, and the scan key stays.
• Flow names are kept as written, and the people your admins allow in the app (Jira admins, the groups they allow, and a project's admins for that project's flows) can read them.
• Alerts and notices are Jira work items. Everyone who can browse the project they are created in can read them.

Anything beyond what these pages describe is in scope. For example, a text from a flow's settings (a JQL query, a web address, a header or a secret) found in the app's storage or logs, or a Jira name kept in clear where these pages say it is not, is a serious finding.

Rules for testing

• Test only on a Jira site that you own or administer, with sample data.
• Use the least access and the fewest requests that show the problem. Do not read, change or delete data that is not yours.
• Stop as soon as you have shown the problem. Do not use a finding to look at more data, to move sideways or to keep access.
• Do not degrade the service for others.
• Do not share details before the disclosure terms below are met.

Safe harbour

We want researchers to report problems. If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take legal action against you, and we will not ask law enforcement to investigate you, for research done under this policy. If a third party takes legal action against you for research that followed this policy, we will say that it was authorized.

This policy covers Plugincraft only. It does not bind Atlassian or any other company, and it does not let you break their rules. If you test Atlassian's services or report through Atlassian's programs, follow their terms. If you are unsure whether something is allowed, ask us first at info@plugincraft.ca.

What to expect from us

These are the deadlines of Atlassian's Security Bug Fix Policy for cloud apps, which we checked on October 27, 2026. Atlassian allows an extension only in limited cases, for example when the fix depends on a change to the Atlassian platform. If we ever need one, we tell you. Business days are Monday to Friday, and business hours are 8:00 to 17:00 Eastern Time. We respond to a vulnerability alert from Atlassian within 8 business hours.

Disclosure and credit

We follow coordinated disclosure. Please keep the details private until we release a fix, or until 90 days after your report, whichever comes first. If the fix deadline for a Low finding is longer than that, we agree a date with you. If we publish an advisory, we credit you by the name you prefer, unless you want to stay anonymous. Plugincraft does not pay rewards for reports yet. See Security practices for our plans.

Reporting through Atlassian

Atlassian's Vulnerability Disclosure Program lets researchers report a vulnerability in a Marketplace app through the Marketplace Security Bug Bounty program. Once TuneCraft is listed on the Atlassian Marketplace, you can use that route as well. Report vulnerabilities in Jira, Forge or other Atlassian products to Atlassian.

Related documents

• Security overview
• Incident Response
• Data Logging
• Privacy policy