Keelcroft / Cross-Site Issue Sync for Jira / Security

Security

How the app is built, what it can reach, and how to report a problem. Contact: support@keelcroft.com, subject “Security”.

Architecture

• The app runs entirely on Atlassian Forge. Keelcroft operates no server, database or relay for it.
• Jira scopes: read:jira-work, write:jira-work and storage:app. Writes on this site are made as the app.
• Egress is limited by the manifest to *.atlassian.net and api.atlassian.com. The partner address an administrator enters must be an HTTPS origin on atlassian.net with no credentials, port, path or query, so it cannot be pointed at an internal or arbitrary host.
• Every administrative action re-checks Jira project administrator rights on the server. The project always comes from the context Jira signs, never from the request body, so one project’s administrator cannot address another project.
• A partner issue can only be linked if it lives in the configured partner project. A project cannot be connected to itself.

Credentials

• The partner email and API token are stored in Forge encrypted secret storage, per connection, and are never returned to the interface or logged.
• Use a dedicated partner account with only Browse projects, Create issues, Edit issues and Transition issues in the partner project. Jira administrator rights on the partner site are optional; they only allow the app to register the webhook.
• The partner can revoke access at any time by revoking the token or deactivating the account; no action on your site is needed.

Inbound webhook

• The webhook the app registers on the partner site is limited to issue created and updated events in the partner project.
• Every delivery must carry Jira’s X-Hub-Signature HMAC-SHA256 signature over the exact request body, made with a 160-bit secret from a cryptographic random source. The signature is checked in constant time before the body is read.
• An unsigned, wrongly signed or unknown delivery receives the same unrevealing 404; the specific reason goes only to the app’s own log.
• A delivery is only ever a hint: it names a partner issue and an update time, and the sync then re-reads both sites itself, so a forged delivery cannot inject content.
• Pausing sync removes the webhook from the partner site and discards the secret.

Data integrity

• Every write is followed by an independent read from the destination and a value comparison.
• Forge delivers events at least once, so deliveries are durably claimed, processed one at a time per connection, and safe to replay.
• Auto-created issues are created first and their status applied afterwards, so a workflow that refuses a status cannot cause a retry to create a duplicate.
• Conflicting edits are held or resolved by the configured policy, never silently discarded.
• The app never deletes an issue on either site. A vanished issue marks the pair failed instead.

What the app logs

One structured line per decision: a check of the partner project, a webhook delivery, a change on this site, an administrator linking or replaying a pair, enabling or pausing sync, and a sync step finishing. Each line carries identifiers and an outcome only — connection id, issue ids, delivery id, event id, status, attempt count and, where something was skipped or refused, the reason. A failed partner request is logged by HTTP status alone.

Issue content is never logged, and neither are credentials or the webhook secret. An automated test sends a signed webhook whose payload carries a summary, a description and labels, and a check whose partner rejects the token, captures everything written to the log, and fails the build if any of that content or any credential appears.

Vulnerability reporting

Report suspected vulnerabilities privately to support@keelcroft.com with the subject line “Security”. Include reproducible steps and impact, but do not access data that does not belong to you and do not send credentials. Critical security reports receive an initial response within one business day.

The app does not claim SOC 2, an independent penetration test, or participation in the Marketplace Security Bug Bounty Program.