unusedapps.com · App Footprint Auditor

Security

The short version: there is no server, no database and no network path out of Atlassian. Most of what a security policy usually has to promise, this architecture makes impossible.

Last updated 26 July 2026. Agon Systems · [email protected]

Architecture

Built entirely on Atlassian Forge and eligible for the Runs on Atlassian programme. The code executes inside Atlassian’s infrastructure, on their runtime, under their controls.
No external network calls. The app contains no fetch() to any outside host and declares no egress or remote in its manifest. This is enforced automatically: a build gate fails the release if either appears.
We operate no infrastructure. No servers, no database, no queue, no logging pipeline, no analytics endpoint. There is nothing of ours for an attacker to reach and nothing of yours for us to lose.
No secrets. The app stores no API keys, tokens or credentials. It authenticates as itself through Forge, using the permissions your administrator granted at install.
Admin-only surface. The single module is a Jira admin page, reachable only by users with Jira administrator access.

Permissions, and why each is needed

The app requests six scopes. Three are named manage: but are used only for reading — Jira gates certain read endpoints behind them, and classic scopes cannot be narrowed further. The app creates, modifies and deletes nothing in your Jira.

Scope	Used for
`read:jira-work`	Custom field definitions, issue keys, and issue history metadata (author and timestamp)
`read:jira-user`	The user directory — this is how installed apps are discovered, via the account Jira creates for each one
`manage:jira-configuration`	Read-only: dashboards and the registry of gadgets each app offers
`manage:jira-webhook`	Read-only: required by Jira to reach `/workflow/search`. No webhook is ever registered.
`manage:jira-project`	Read-only: required by Jira to reach screen configuration. No project is ever modified.
`storage:app`	Storing the renewal costs your administrator types in

Every endpoint the app calls: /field/search, /dashboard, /dashboard/{id}/gadget, /dashboard/gadgets, /workflow/search, /users/search, /search/jql (issue keys only) and /changelog/bulkfetch. All are GET or read-only POST.

Data handling

No issue content is ever read — no summaries, descriptions, comments, attachments or field values.
Nothing is transmitted to us. We cannot see your app inventory, your findings, your costs, or whether you ran a scan at all.
The only stored data is the renewal costs an administrator enters, held in Atlassian Forge app storage on your own site. Uninstalling the app deletes it.
No sub-processors. Nothing is shared with any third party, because nothing leaves Atlassian in the first place.
Data residency is Atlassian’s, inherited from your own site’s configuration. We introduce no additional region or transfer.

Full detail of what is read and why is on the privacy page.

Reporting a vulnerability

Email [email protected] with “security” in the subject. Please report privately before disclosing publicly. Acknowledgement within one business day. If you have found something real you will be credited unless you prefer not to be. See the support page for response targets.

Vulnerabilities in Atlassian Forge or Jira itself should go to Atlassian’s vulnerability programme rather than to us.

Development practice

Every change runs a build gate: unit tests, lint, an egress check, a webtrigger check, and an eligibility check that would fail the release if the app stopped qualifying for Runs on Atlassian.
The interface is tested by driving the real page in a real browser against a live Jira site, not only by unit tests — because every serious defect in this app’s history passed its unit tests.
Known limitations are documented publicly rather than discovered by users. See the terms and the app’s own results screen.

Stated plainly: this is a very small operation. There is no 24/7 security team and no formal incident-response rota. What there is instead is an architecture with almost no attack surface, and an honest account of it on this page.