Where secrets hide
Confluence pages, blog posts, live docs, comments, page versions and attachments. Jira summaries, descriptions, text fields, comments, field history and attachments.
Jira Cloud + Confluence Cloud · Runs on Atlassian · Zero egress · Rovo agent
LeakRadar
Secret and Personal Data Scanning for Jira and Confluence
LeakRadar finds API keys, tokens, passwords, private keys, connection strings and personal data pasted into Jira work items and Confluence pages. It helps your team triage and clean them up, and keeps the evidence your auditor asks for. Everything runs inside Atlassian, including the AI.
Requires Jira, works with Confluence: one app and one licence for both. Built on Atlassian Forge and distributed through Atlassian Marketplace.
- Jira and Confluence in one app
- Deterministic detectors plus AI triage inside Atlassian
- Never stores a raw secret or personal data value
- Rotate, redact, purge versions and restrict access
What LeakRadar does
Precise detectors
Cloud credentials, code and CI tokens, private keys, connection strings, card numbers, IBANs, national IDs with jurisdiction packs, health identifiers, HAR files and Trojan Source characters, with checksums and validators.
Fewer false positives
Atlassian-hosted Forge LLMs review only ambiguous candidates, with the candidate itself replaced by a shape description. The AI can lower noise and never hides a high-confidence credential.
Owners, due dates and SLAs
Confirm, mark as false positive, resolve or accept risk with a reason. Assign owners, set due dates from SLAs by severity, save views and act in bulk.
Rotate first, then clean up
Playbooks per detector, assisted redaction in place, Confluence version purge, attachment actions, access restriction, sensitivity labels and remediation work items.
Proof for your auditor
CSV, JSON and PDF exports with coverage and limitations, signed PDF reports in a hash chain with a Verify screen, and a scheduled monthly evidence pack.
Masked, hashed, located
LeakRadar stores a masked snippet, a keyed hash and the location. The full value is discarded at the end of each scan.
Who can see it
An exposure score raises severity when content is visible to anonymous users or the whole site, and an access explorer shows who can see an item.
DSAR and erasure
Find every mention of an email address or national ID with a hashed lookup, then run a GDPR Article 17 erasure workflow with an erasure record.
Runs on Atlassian
Nothing leaves Atlassian
No external hosts, no Forge Remote, no Connect. No email, Slack or webhooks. Alerts reach people through Jira work items and Jira notifications.
Forge LLMs, hosted by Atlassian
AI triage uses Forge LLMs, which run inside Atlassian. Prompts and responses are not stored, and an administrator can switch AI triage off.
Forge SQL with your residency
Findings, decisions and reports live in Atlassian Forge hosted storage, following your site's data residency.
Rovo agent
Ask the LeakRadar agent in Rovo to triage, plan remediation, check a page before sharing or summarise a quarter for your auditor. It answers from LeakRadar findings that you are allowed to see and asks before every change.
Conversation starters
- Triage my open critical findings.
- Build a remediation plan for the PAY space.
- Is this page safe to share?
- Where do we have national ID numbers in Confluence?
- Write the audit summary for Q3.
Values never enter the chat
- Never outputs, reconstructs or asks for a secret or personal data value
- Results are filtered to content you can see
- States exactly what will change and waits for your confirmation
- Redaction and erasure open the app screen, where you see the masked preview
Part of the Radrly family
AccessRadar answers who can access what. LeakRadar answers what sensitive data sits there and where. Both use the same evidence language: masked data, hashes and signed reports. ConfigRadar tracks configuration changes and MarginRadar covers cost and margin. LeakRadar is the first Radrly app that also covers Confluence.
Requirements and notes
- Jira Cloud is required. Confluence Cloud on the same site is supported with the same licence.
- A Jira administrator installs and configures LeakRadar. Day-to-day work is done by the LeakRadar team and by space and project administrators.
- LeakRadar cannot check whether a secret is still active at its provider, because that would need a call outside Atlassian. Rotate every confirmed secret.
- Built on Atlassian Forge with no external calls. See Security and Privacy.