Issue Templates by Taskhooker — Security Information
This document describes the security posture of Issue Templates by Taskhooker, the Atlassian Marketplace app. It is intended for security reviewers at customer organisations evaluating Issue Templates by Taskhooker for installation.
Platform
Issue Templates by Taskhooker is built entirely on Atlassian Forge, Atlassian's hosted application platform. Issue Templates by Taskhooker operates no third-party servers and runs no code outside Atlassian's network. No End-User Data is transmitted outside Atlassian's infrastructure.
What this means in practice
- Every function call executes in Atlassian's sandboxed Node 24 runtime
- Every storage write goes to Forge Key Value Store (encrypted at rest, AES-256, Atlassian-managed)
- Every outbound network call is whitelisted in the Forge manifest and proxied through Atlassian
- The app cannot run code on your servers or your users' machines
Permissions
Issue Templates requests the following Atlassian Jira scopes:
| Scope | Reason |
|---|---|
read:jira-user |
Look up assignable users and display names only when an admin prefills an assignee or user-type field on a template |
read:jira-work |
Read projects, work item types, and Create-screen field metadata so templates can be authored |
write:jira-work |
Apply a template: set field values on the work item being created and create its child work items (Epic → Story → Subtask) |
manage:jira-configuration |
Create and maintain the app-owned "Apply Template" field, its scoped field contexts, and the UI modifications that drive live apply |
manage:jira-project |
Maintain the field context / configuration at the project level for live apply |
storage:app |
Store authored templates in Forge Key Value Store |
The app requests no external network egress — there is no permissions.external.fetch entry because the app never calls any external host.
Authentication
The app calls the Jira REST API through Forge using the app context (asApp()) for authoring, configuration, storage, and template application. Atlassian's platform authorises every call against the app's granted scopes.
The app uses no customer-supplied API keys, no OAuth client credentials, and stores no tokens. There are no other authentication paths and no external identity providers.
Secret handling
None. Issue Templates stores no secrets, no API keys, no OAuth tokens, and no encryption keys. It has no settings panel for entering credentials and makes no kvs.setSecret() calls. The only data it stores is the templates an admin authors (see the Privacy policy). There is nothing to rotate or revoke.
Account actions
The app's writes are limited to:
- Applying a template — setting field values on the work item being created and creating its defined child work items, in the project where the template is used.
- Managing its own Jira configuration — the "Apply Template" custom field, scoped field contexts, and UI modifications required for live apply.
The app does not modify or delete existing work items, does not change, deactivate, or reclaim user accounts, and does not alter any Jira content outside the templates it manages and the work items explicitly created from a template. Child-tree creation runs asynchronously on Atlassian's Forge queue and is idempotent.
Architecture and guarantees
The Create-screen read path is intentionally minimal: it performs a single Key Value Store read of a pre-built per-(project, work-item-type) index — never a scan, never a Jira call, never loading template bodies. Broad scopes ("all projects", "by category", "by project type") are compiled into concrete per-project index entries at authoring time, with large fan-outs offloaded to Atlassian's Forge queue to respect the platform's runtime limits.
Targeting, validation, and tree-planning logic live in pure TypeScript functions in src/lib/, unit-tested with Vitest (90+ tests). There is no AI, no analytics, no telemetry, and no third-party SDK of any kind in the app. The only network calls are to Atlassian's own Jira REST API inside the Forge runtime.
Vulnerability reporting
Security vulnerabilities can be reported to security@taskhooker.com. We commit to acknowledging reports within 5 business days and disclosing patches via the Marketplace "What's new" section.
Issue Templates by Taskhooker is a solo-developer product. We do not currently operate a paid bug bounty programme.
Compliance
Issue Templates by Taskhooker inherits the security and compliance posture of the underlying Atlassian Forge platform. Atlassian Forge is certified under:
- SOC 2 Type II
- ISO 27001 / 27017 / 27018
- PCI-DSS (for the platform itself; Issue Templates by Taskhooker does not handle payment data)
- GDPR and CCPA compliance commitments
Issue Templates by Taskhooker itself does not have independent certifications. The app code is reviewed by Atlassian as part of the Marketplace listing approval process.
Audit & change history
For your records, every code change to Issue Templates by Taskhooker is reflected in the What's new section of the Marketplace listing for each version. The Marketplace partner portal also exposes a full version history for compliance audits.