Security Policy

Overview

This page describes how Scriptix Labs secures Pulse (the Jira Cloud app) and Pulse Companion (the browser extension), and how we handle security reports and incidents. For what data each product stores, see our Privacy Policy.

Both products are built around a single principle: we hold as little as possible and run as close to your data as possible. There is no Scriptix Labs server, database, or analytics pipeline behind either product — so there is no central store of customer data for us to lose.

Architecture & data handling

• Pulse (Jira app) is an Atlassian Forge app that runs entirely on Atlassian's infrastructure("Runs on Atlassian"). It makes no network calls to external hosts (no data egress), runs no remote code, and collects no analytics. All Jira access is performed as the signed-in user (asUser()), with that user's own Jira permissions — never with elevated app-level access. App configuration is stored in Atlassian Forge storage; worklogs are native Jira worklogs owned by Jira, not by us.
• Pulse Companion (extension) is a client-side browser extension with no Scriptix Labs backend. Your Jira credentials (site URL, email, API token) and preferences are stored only in your browser's local extension storage and are never transmitted to us. All requests are made directly from your browser, with your own credentials, to your Jira Cloud site (and, only if you enable calendar import, to Google or Microsoft).

Security controls

• Least privilege. The Jira app requests only the minimum OAuth scopes it needs (read/write:jira-work, read:jira-user, storage:app). The extension requests only the host and storage permissions required for its features.
• No data egress or third-party sharing. The Forge app sends nothing outside Atlassian. Neither product uses third-party analytics, advertising, or tracking SDKs.
• Input validation. Every server-side resolver in the Jira app validates its inputs against a strict schema before acting on them.
• Secrets handling. The Jira app requires no user-supplied secrets. The extension stores your Jira API token only in local browser storage for authenticating to Jira as you; it is never sent to Scriptix Labsand never written to logs.
• No sensitive logging. We do not log credentials, tokens, or personal data.
• Secure development. Code is written in strict TypeScript and passes automated type-checking, linting, and tests before release. Changes are reviewed before they ship.

Vulnerability management

• We track third-party dependencies and run automated dependency / open-source vulnerability scans (SCA), and we keep dependencies current.
• We monitor security advisories relevant to our stack (Atlassian Forge, the browser extension platform, and our libraries) and prioritise remediation of issues that affect the shipped products.
• We follow Atlassian's Marketplace security bug-fix policy for time-to-fix targets on reported vulnerabilities by severity.

Reporting a security issue

If you believe you have found a security vulnerability in Pulse or Pulse Companion, please report it to security@scriptixlabs.com. Where possible, include a description of the issue, the affected product and version, and steps to reproduce.

We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and that testing avoids privacy violations, data destruction, or service disruption. We will not pursue action against good-faith security research conducted under these guidelines.

Incident handling

When a security issue is reported or detected, we:

1. Acknowledge the report and begin triage promptly.
2. Assess severity and impact, and confirm whether it is exploitable.
3. Develop, test, and release a fix, prioritised by severity.
4. Notify affected customers and Atlassian where required, in line with Atlassian's Marketplace security incident and vulnerability notification guidelines.

Contact

Security reports: security@scriptixlabs.com. General support: support@scriptixlabs.com.