ZCODESSecurity
How ZCODES apps protect your data.
Architecture
- Runs on Atlassian. Apps are built on Atlassian Forge and are eligible for the Runs on Atlassian programme: compute and storage are hosted by Atlassian, and the apps make no outbound network calls.
- Inbound webhooks only. Data enters through Forge web triggers with static responses, so nothing from your site is sent back to the caller.
- Verified senders. Sentry and CircleCI webhooks are verified with HMAC-SHA256 using constant-time comparison; other senders need a 48-character random token. Invalid requests are rejected before any processing.
- Secrets. Client secrets, signing tokens and webhook tokens are stored in Forge's encrypted secret storage. Client secrets and signing tokens are never shown again after saving; the generic webhook token is shown only to Jira administrators, inside its URL, and can be rotated at any time.
- Least privilege. Settings actions check that the caller is a Jira administrator. Scopes are limited to what each feature needs.
- Licensing. Apps stop processing when their subscription is inactive.
Scopes
| App | Scope | Why |
|---|---|---|
| Error Autopilot | read:jira-work, write:jira-work | Create, comment on, transition and label issues; set the issue property used for the panel and JQL. |
| Error Autopilot | read:jira-user | Optional assignee sync: find the Jira user that matches the Sentry assignee's email. |
| Both | storage:app | Settings, encrypted secrets, issue links, activity log. |
| Build Beacon | read:jira-work, write:jira-work | Send builds and deployments, comment on failures, set the issue property used for JQL. |
Reporting a vulnerability
Email support@behumbot.xyz with the subject "Security". We acknowledge within 2 business days and keep you updated until it is fixed. Please don't publicly disclose issues before we have released a fix.