This page describes how the Lumas Forgery team ("we", "us") secures Space Roles Manager
— an Atlassian Forge app for Confluence Cloud — and how to report a security issue.
1. Architecture and hosting
Space Roles Manager is a "Runs on Atlassian" Forge app. It runs entirely within Atlassian's
Forge platform; we operate no servers, databases, or infrastructure of our own. The underlying compute,
network, storage, runtime isolation, patching, and physical security are therefore managed by Atlassian under their
security program. The app makes no network calls to systems outside Atlassian's cloud (no external
egress).
2. Reporting a security issue
If you discover a security vulnerability in Space Roles Manager, please report it to
security@lumasforgery.com. Please include steps to
reproduce, the affected area, and the potential impact. We ask that you give us a reasonable opportunity to
remediate before any public disclosure, and that your testing does not access, modify, or destroy data belonging
to others, or degrade the service. We do not currently operate a paid bug-bounty program, but we are grateful for
responsible disclosure.
3. Vulnerability management
Acknowledgement — we aim to acknowledge a report within 2 business days.
Triage — we assess each report for severity and exploitability (impact × likelihood) and
prioritize accordingly.
Remediation — we fix confirmed vulnerabilities within the timeframes defined by the
Atlassian Marketplace
Security Bug Fix Policy, prioritized by severity (Critical → High → Medium → Low). Fixes are deployed to the
Forge production environment, from which all installations are served.
Sources — in addition to direct reports, we act on issues surfaced by Atlassian's automated
Forge security checks (e.g. the Marketplace security scanner / FSRT), Atlassian security advisories, and
dependency vulnerability scanning.
4. Security incident handling
If a security incident affects the app, our process is to:
Contain — deploy a fix or, where necessary, request that the affected app version be disabled.
Assess — determine the scope, the data involved, and the impact.
Remediate & verify — ship and confirm the fix.
Notify — inform affected customers and Atlassian as required, and cooperate with Atlassian's
security team throughout.
5. Technical and organizational controls
Access control and authorization
The app requests least-privilege OAuth scopes — only the Confluence permissions needed to
read and manage space roles.
The app authenticates Confluence requests as the signed-in user, so Confluence enforces each
user's own permissions. Non-administrators cannot perform privileged actions through the app.
Source code is held in a private repository with access limited to authorized maintainers.
Deployments are performed only via the authenticated Atlassian Forge CLI using API tokens.
Multi-factor authentication is enforced on the developer's Atlassian and source-control accounts.
Data protection
No customer data is stored outside Atlassian. App configuration, role templates, and
anonymous usage counters live in Atlassian Forge Storage, scoped to each installation.
Data is encrypted in transit (TLS) and encrypted at rest by Atlassian's
platform.
The app handles no passwords or credentials and does not log personal Confluence content.
Monitoring and logging
We use Atlassian Forge's platform logging and metrics to observe app behavior and investigate issues.
We monitor Atlassian's developer and security communications and Marketplace security findings.
Secure development
Changes are reviewed and tested before deployment.
Dependencies are kept up to date and scanned for known vulnerabilities.
Each release is validated against Atlassian's Forge security checks prior to submission.
6. Shared responsibility
Platform-level security — infrastructure, networking, physical security, runtime isolation, and storage
encryption — is provided by Atlassian under their security and compliance programs (see the
Atlassian Trust Center). Our responsibility covers the security of
the app's code, configuration, requested scopes, and our handling of vulnerability reports and incidents.