Security Policy
Last updated: July 21, 2026
FileWarden is an Atlassian Forge app. It runs entirely on Atlassian-hosted compute and storage, makes no external network egress, and stores no data outside Atlassian - eligible for the Runs on Atlassian badge. TLS 1.2+/HSTS and 28-day data deletion on uninstall are provided by the Forge platform (a recovery request is possible within 21 days).
Runs on Atlassian
Every part of FileWarden - compute and storage - runs on Atlassian-hosted infrastructure. There is no external service, no egress, and no partner-side data store, so the attack surface outside Atlassian is none.
Found something? Tell us privately.
Please report suspected security issues privately - do not open a public GitHub issue.
Email us
Write to security@kuberstar.com. The security contact for this app is registered on an ecosystem.atlassian.net account, per Atlassian's requirements.
Or via Atlassian
Raise a ticket through the Atlassian Marketplace AMS process, which routes security reports to the registered contact.
Fix windows we commit to.
We follow Atlassian's Marketplace Security Bug Fix Policy remediation SLAs.
| Severity | CVSS | Fix within |
|---|---|---|
| Critical | ≥ 9.0 | 10 days |
| High | ≥ 7.0 | 4 weeks |
| Medium | ≥ 4.0 | 12 weeks |
| Low | < 4.0 | 25 weeks |
A small, explicit footprint.
What it does
- Reads Jira issue and Confluence attachment metadata, lists projects, and checks permissions.
- Scans attachment content on-platform for leaked secrets and PII - text files directly, and text extracted from PDF and Office documents - without showing or logging the matched value.
- Deletes (Jira) or trashes (Confluence) attachments that violate the configured policy, and can quarantine instead of deleting on Pro.
- Posts an explanatory comment naming the policy that was broken.
- Resolves an uploader's Jira group membership so rules and exemptions can be scoped by group.
- Stores policy, settings, and audit records in Forge KVS.
What it does not
- Collects or stores Atlassian account credentials or API tokens.
- Calls any external service or performs network egress - the content scan runs entirely on Atlassian.
- Shows or logs the secret or PII value it matches - only a masked, length-only fingerprint is recorded.
- Performs antivirus or malware analysis, or runs OCR or image scanning - an image-only or encrypted document is treated as unreadable, never as a match.
Authorization
Every admin and config resolver endpoint, and every Rovo agent action, verifies the caller holds the Jira ADMINISTER permission server-side; Pro features additionally require an active license. Background work runs as the app (asApp); user-facing reads run as the user (asUser). Inputs supplied to the Rovo agent by the model are never trusted for authorization.
Eight scopes, no egress.
Four for Jira and app storage, four for Confluence attachment governance. No other scopes and no external egress permissions are declared.
read:jira-workRead issues and attachment metadata, read attachment content for the scan, list projects, check permissions.
write:jira-workRemove or quarantine violating attachments and post the policy comment.
storage:appForge KVS for policies, audit log, idempotency markers, and settings. No external storage.
read:jira-userResolve an uploader's Jira group membership for per-group rules and exemptions. Read only.
read:confluence-content.summaryRequired by the Confluence attachment product event.
read:attachment:confluenceList and read Confluence attachments to evaluate them.
delete:attachment:confluenceMove a disallowed Confluence attachment to Space Trash, where it stays recoverable.
write:comment:confluencePost the remediation footer comment.
Questions about this policy? Email security@kuberstar.com or visit the KUBERSTAR support page.