Security

Report vulnerabilities to contact@pledona.com. We acknowledge within 2 business days and aim to fix critical issues within the timelines in Atlassian's Security Bug Fix Policy. Please give us reasonable time to fix before public disclosure. Don't access other customers' data or degrade service while testing.

How Threadline for Jira is built

• Runs entirely on Atlassian Forge. Pledona operates no servers and has no access to customer Jira data.
• Least-privilege scopes: read:jira-work, read:jira-user, storage:app.
• Network egress is limited by the Forge manifest to chat.googleapis.com. URLs are validated before each request.
• Webhook URLs are stored with Forge encrypted secret storage, are never shown in full, and are never logged.
• Only Jira administrators can view or change configuration. This is checked server-side on every request.
• Logs contain metadata only (issue key, result), with no issue text or comment content.
• Dependencies are scanned with npm audit before each release.