Security

Small attack surface by design.

RuleSignal is a Forge Custom UI app with zero Jira API scopes, no backend functions, no remote, and no vendor storage.

Technical controls

Strict 5 MB input boundary and maximum parser nesting depth.
Strict JSON parsing without evaluating scripts, templates, JQL, URLs, or smart values.
DOM text rendering and HTML escaping for offline reports.
No Jira read or write API path.
No customer-data logs, third-party analytics SDK, upload endpoint, database, or AI processing.
Only three payload-free Atlassian-hosted counters for completed real workflows.
TypeScript strict checks, automated tests, dependency audit, and Forge lint before release.

Report a vulnerability

Security contact: security@rulesignal.app. Atlassian ecosystem contact registration remains a pre-submission gate.

Include the affected version, reproduction steps, observed impact, and a minimal synthetic proof. Do not include customer exports, credentials, or personal data. Do not publicly disclose an unresolved issue before coordinated remediation.

Incident handling

Suspected release compromise, parser or report injection, unauthorized Marketplace access, and any privacy-boundary regression are handled under the internal incident-response process. Customer notification and legally binding commitments require the approved operational contacts and final policy.

Not yet claimed

RuleSignal does not currently claim Cloud Fortified status, a security certification, penetration-test coverage, or formal compliance certification.