CloseReply runs on Atlassian Forge, stores app data in Forge-hosted services, and has no external network egress configured.
Hosting and data flow
The app UI and functions run on Atlassian Forge. Templates, signatures, folders, actions, and preferences use Forge hosted storage. Uploaded template files use Forge Object Store. Jira data is requested on demand to render a response or complete an action selected by the current user.
Permissions
CloseReply currently requests the following Jira and Forge scopes:
- Read Jira work and users: resolve issue details and user-aware variables.
- Write Jira work: add a confirmed comment, attach a selected file, update a field, transition an issue, or create a follow-up request.
- Read and write service requests: support Jira Service Management request workflows selected by the user.
- App storage: store the app configuration and customer-created response content.
Product API requests are made in the context of the current Jira user where appropriate, so Jira permissions continue to apply.
Access boundaries
- Installation data is isolated by Atlassian site.
- Personal signatures and stars are tied to an Atlassian account.
- Project content is limited to its project scope.
- Administrative controls protect project and global configuration.
- Customer portal access is opt-in per template and uses a reduced, sanitised payload.
Operational practices
- Dependencies and Forge platform changes are reviewed during development.
- Permissions are kept to the minimum required by supported workflows.
- Sensitive values and customer credentials are not requested through support.
- Security reports are triaged promptly and handled confidentially.
Report a security issue
Email [email protected] with “Security report” in the subject. Include the affected app, impact, reproduction steps, and a safe way to contact you. Do not include live credentials or unnecessary customer data.