Security policy, JQL Gaps for Jira

This is the security policy for the Jira Cloud app JQL Gaps for Jira, published by TooLooLoo. It states how to report a vulnerability, what is promised in return, and what the app does with the data it reads. Every claim below is enforced by the app's Forge manifest or by an automated test, and can be checked by a Jira administrator without taking our word for it.

Last updated: 29 August 2026.

Reporting a vulnerability

Write to support@toolooloo.fr Please include what you observed, the steps to reproduce it, and the function name and arguments involved, with any sensitive values in the example replaced.

What you get back:

• An acknowledgement within two business days.
• An assessment, with a severity and an intended fix date, within five business days.
• A fix shipped as a Forge deployment, which reaches every installation without any action from the customer. There is no version for a customer to install and no window during which some sites stay vulnerable.

Please report privately first and give us the time above before disclosing publicly. We will credit you when the fix ships, unless you prefer otherwise.

There is no monetary bounty. We would rather say so than imply one.

Scope

In scope: the app's 26 JQL functions, its scheduled and issue-change triggers, its reference page, and this website.

Out of scope: Atlassian's own products and infrastructure, which belong to Atlassian's bug bounty programme; findings that require a Jira administrator to already be malicious; and reports produced only by an automated scanner with no demonstrated impact.

What the app can reach, and what it cannot

No data leaves Atlassian. The app declares no external domain in its manifest and makes no outbound call. This is not a promise about our conduct, it is a property of the manifest: adding a single outbound address, even for an image, removes an app from Atlassian's Runs on Atlassian programme, and eligibility is re-checked at every deployment.

There is no inbound entry point. The app has no web trigger. Every entry point is a JQL function called by Jira's own search engine, a scheduled trigger, an issue-change trigger, or the app's own static reference page. There is no URL anyone on the internet can call.

Six permission scopes, all narrow, none of them "edit issues". read:jira-work, read:jira-user, read:sprint:jira-software, read:field:jira, write:field:jira, write:app-data:jira. The app never holds write:jira-work, so it cannot create or edit a work item, and it never touches Forge's own storage: it requests no storage:app scope at all.

We hold no credential. Forge supplies the authenticated client. The app never asks a user for a Personal Access Token, a password or any other shared secret, and would have nowhere to put one.

Where your data lives

Nowhere but Jira. The app's only persisted state is a single custom field it owns, written through the Jira API endpoint reserved for an app's own fields — no other app or user can write to it. There is no database, no server and no third party. Uninstalling the app removes that field and every value it ever wrote.

How search results stay within your own permissions

Every function's Jira reads run with the app's own access, which is what lets four of them answer instantly across a whole instance instead of scanning it. What those reads find is never shown directly: a function returns a list of issue identifiers, which Jira itself re-evaluates under the searching user's own permissions before displaying anything, exactly as it does for any other part of a JQL search. An issue you cannot browse is filtered out by Jira, not by this app.

Development practices

• Pure business logic is separated from Forge and runs under a plain Node test runner: 211 tests, no network.
• A manual security review found and fixed a denial-of-service pattern in how user-supplied regular expressions were validated (catastrophic backtracking); the fix rejects the dangerous shape before a pattern is ever compiled.
• A second, tool-assisted review traced every function argument from input to the query it can reach, confirming each is constrained by a fixed allow-list, a strict identifier pattern, or a slugging function that strips anything outside [a-z0-9-].
• Runtime dependencies are Atlassian's own @forge/* packages and React.
• Dependencies are checked for known vulnerabilities before each deployment.
• No secret is stored in the source repository, and the app holds none.

Contact

support@toolooloo.fr