Security Policy
Cycle Time Scatter Chart for Jira Dashboard
Last updated: 1 October 2026
This app is published on the Atlassian Marketplace by the partner flowscope. This page states how the app is built and what it can and cannot reach. It is written to match the app's source code and its Forge manifest, not to describe a general policy.
1. Where the code runs
| Component | Where it executes |
|---|---|
| Backend (resolver) | Atlassian Forge, on Atlassian's infrastructure (nodejs22.x runtime).
No partner-operated server is involved. |
| Frontend (gadget UI) | The end user's browser, inside the Jira page. |
There is no infrastructure operated by the publisher. The app has no server, no database and no hosting of its own.
2. Permissions and identity
The app requests exactly one OAuth scope:
read:jira-work
It is read-only. It never writes to Jira — it does not create, edit, transition or delete issues, and it does not change any configuration outside its own gadget settings.
Every Jira request is made as the user who is viewing the gadget, using Forge's built-in OAuth. The app never uses an administrative identity, and it can only read what the person looking at the dashboard is already permitted to see.
3. Network access
4. Secrets
The app never asks for an Atlassian API token, a password, or any other shared secret. Authorization is handled entirely by Atlassian's OAuth flow; the app stores no credential and no token. There is nothing for a user or an administrator to generate, copy or paste.
5. What is read, and what is stored
What the app reads from Jira, and the short-lived cache it keeps, are described in full in the Privacy Policy. In summary: it reads issue keys, status transition history and creation dates; it does not read issue summaries, descriptions, comments or attachments. Any cache it keeps lives in Atlassian Forge storage and expires on its own. No data is sent to, or stored by, the publisher.
6. Data residency
The app processes and stores data exclusively within Atlassian apps and services. It defines no data egress, so there is no external location for data to reside in.
7. Reporting a vulnerability
Please email wangxydlut@gmail.com with a description of the issue and, where possible, the steps to reproduce it. Please do not open a public issue for a security report.
This is a small app maintained by one person. Reports are handled on a best-effort basis and there is no guaranteed response time and no bug bounty programme.
8. What this page does not claim
The app holds no security certification, no independent audit and no compliance attestation (for example SOC 2, ISO 27001 or a completed CAIQ). Nothing on this page should be read as claiming otherwise. Where the app relies on Atlassian's own controls — infrastructure, OAuth, storage, logging — those are described in Atlassian's own security documentation, not here.