Security
Last updated 19 October 2026
How the apps are built
Both apps are Atlassian Forge apps that qualify for Atlassian's Runs on Atlassian program. Their code runs on Atlassian's infrastructure. There are no servers or databases of ours, and the apps make no calls to anything outside Atlassian.
What each app can access
| App | Permission | What it is used for |
|---|---|---|
| Epic Progress | Read Jira work (read:jira-work) | Reading epics, their child issues and field names. Every request runs as the person viewing the dashboard, so they only see what Jira already lets them see. The app cannot change issues. |
| Dashboard Notes | App storage (storage:app) | Saving note text, images and the last five versions in Atlassian's app storage for your site. It does not read your Jira issues. |
Data and logs
- Epic Progress stores nothing of its own. The gadget settings are stored by Jira with the dashboard.
- Dashboard Notes stores notes in Atlassian's app storage. Notes are deleted when the app is uninstalled, in line with Atlassian's data retention rules.
- App logs record only the type of an unexpected error and an HTTP status code, not issue or note content. Logs stay in Atlassian's developer console.
More detail is in the privacy policy.
Report a security problem
Please report security problems privately, not in a public issue: email security@harshkamdar.com, or report a vulnerability on GitHub. Only the maintainer can see these reports.
You will get a reply within two business days. Confirmed problems are fixed and released as soon as they are tested, and you will be told when the fix is live.
What we do not have
The apps are made by one developer. There is no SOC 2 or ISO 27001 certification and no formal bug bounty. The security of the platform itself (hosting, storage, authentication) is Atlassian's, as described in Atlassian's Trust Center.