Security

Architecture

LeakRadar is built entirely on Atlassian Forge and declares no remotes and no external permissions, which is what Atlassian's Runs on Atlassian programme requires. The badge itself is awarded by Atlassian. The app has no servers of its own.

• User interface: Forge Custom UI with the Atlassian Design System and design tokens, in light and dark themes. It talks only to the app's own Forge functions and loads no external scripts, fonts or frames.
• Logic: Forge functions, scheduled triggers, product event triggers and queue consumers inside Atlassian.
• Storage: Forge SQL and the Forge key-value store (hosted storage), on Atlassian infrastructure.
• No remotes: no Forge Remote, no Connect, no web triggers, no backend operated by Radrly, and no public REST API.

Data flow

Inside the Atlassian cloud, LeakRadar reads data from Jira Cloud and Confluence Cloud through Forge platform APIs, computes its results in Forge functions, stores them in Forge hosted storage and shows them to authorised users inside the Atlassian product. Nothing leaves Atlassian: there is no connection to external servers, third-party APIs or external AI services.

LeakRadar writes to Jira or Confluence only for actions a user confirms (redaction, version purge, attachment actions, restrictions, labels, markers), which run as that user; for auto-remediation policies a Jira administrator approved, which run as that administrator after a 7-day dry run; and for the remediation, alert and evidence work items you configured.

Exports are generated for download by the signed-in user. Radrly receives no customer data.

Scopes

LeakRadar declares all of its scopes in its Forge manifest. They are shown when you install the app and on the Marketplace listing. Version 1.0 requests these scopes:

• read:jira-work (Jira): Read work items, text fields, comments, field history and attachment content to scan them; check that you can see an item.
• write:jira-work (Jira): Redact values in fields and comments as you, create remediation and alert work items, send Jira notifications, attach evidence packs.
• read:jira-user (Jira): Show names and avatars of owners and team members; nothing is cached.
• read:confluence-content.summary (Confluence): Receive page, blog post, live doc and comment events.
• read:page:confluence (Confluence): Read pages, blog posts and page versions; check that you can see a page.
• write:page:confluence (Confluence): Redact values in pages and blog posts as you.
• read:comment:confluence (Confluence): Read footer and inline comments.
• write:comment:confluence (Confluence): Redact values in footer and inline comments as you.
• read:attachment:confluence (Confluence): List attachments.
• readonly:content.attachment:confluence (Confluence): Download attachments to scan them in memory.
• write:confluence-content (Confluence): Delete old page versions that still contain a confirmed value, as you.
• read:space:confluence (Confluence): List spaces for the scan scope, the backfill and exposure checks.
• storage:app (Both): Forge SQL, the Forge key-value store and Forge secret storage for the hashing key.
• report:personal-data (Both): Atlassian's personal data reporting for stored account IDs.

• How write scopes are used: edits run as the person who confirms them, so Jira and Confluence apply that person's permissions. Auto-remediation policies run as the Jira administrator who approved them, through Forge offline user impersonation, after a 7-day dry run. Alert, digest and evidence work items are created by the app in the security space you choose and contain masked values only.
• Still being confirmed: deleting or replacing attachments, Confluence page restrictions and space permissions, and Confluence labels and content properties may need additional scopes. Any such scope is added to this list before release. If Marketplace review refuses one, that action is left out of version 1.0.
• Modules: the Forge llm module for AI triage inside Atlassian, the Rovo agent and its actions, and Forge SQL.

LeakRadar declares no external hosts (permissions.external), no remotes and no web triggers.

No egress

LeakRadar declares no external hosts and makes no outbound network calls. It uses no Forge Remote, no Connect, no web triggers and no fetch to external services. There are no Slack, Teams or email webhooks. The app sends no telemetry to Radrly or any third party.

Requests to Atlassian products use Forge's authenticated platform APIs. The app does not handle passwords, personal access tokens or shared secrets.

Data protection

• At rest: data is stored in Atlassian's Forge hosted storage, which Atlassian encrypts at rest.
• In transit: traffic between the browser, the Atlassian products and Forge uses TLS, managed by Atlassian.
• Data residency: app data follows the data residency location of your site. Radrly does not store data anywhere else.
• Minimisation: LeakRadar never stores a raw secret or personal data value. Not stored: raw secret or personal data values, rendered page or work item content, AI prompts and responses, IP addresses. Content, including attachment text, is processed in memory during a scan and discarded.
• Logs: the app logs operational status, job identifiers, counters and timings in the Forge developer console, without personal data or customer object names.

Access control

• Server-side checks first: every resolver and Rovo action checks on the server that the signed-in user is a Jira administrator, a member of the LeakRadar team or holds a delegated LeakRadar role for that space or project, and that the user can see the source item, before it reads any data as the app. Roles, space lists and flags sent by the browser are never trusted.
• Writes as the user: redaction, version purge, attachment actions, restrictions and labels run as the person who confirms them, so Jira and Confluence enforce that person's edit rights. Auto-remediation policies run as the approving Jira administrator and pause if that administrator loses the rights.
• Validated input: every payload is validated against a schema; Forge SQL queries use prepared statements only.
• No Radrly backend: the app has no code path that sends your data to Radrly, and Radrly operates no server that holds it.

Data lifecycle

• Install: the app asks for the scopes above and creates its storage.
• Use: Open, confirmed and accepted risk findings are kept while they stay in that state. Resolved and false positive findings are kept for 13 months by default; a Jira administrator can change this period in Settings (90 days to 24 months). The audit log is kept for 13 months and signed report hashes for 7 years, so earlier evidence can still be verified.
• Uninstall: the Forge platform deletes the app's data according to Atlassian's policy for Forge hosted storage. Radrly keeps no copy.

See the Privacy Policy for details.

AI statement

LeakRadar uses Forge LLMs, Atlassian-hosted models available to Forge apps, to triage ambiguous candidates. AI triage is on by default when LeakRadar is installed, and a Jira administrator can switch it off in Settings. Requests contain masked context with the candidate replaced by a shape description. Prompts and responses are not stored.

Compliance

LeakRadar runs on Atlassian Forge. Atlassian's platform certifications cover Forge hosting; Radrly does not claim them as its own. For Atlassian's reports, see the Atlassian Trust Center. Radrly will complete the Marketplace security requirements that apply to the app.

Incident response

If Radrly becomes aware of a security incident affecting customer data in LeakRadar, we will notify affected customers without undue delay, and in any event within 48 hours, with the information available to us, and keep them updated.

Secure development

• Automated checks before every production deployment: formatting, linting, type checking, unit tests and Forge lint.
• Dependency updates and vulnerability checks on production dependencies, and static code analysis.
• Secrets only in the build system; no secrets in the code.
• Runs on Atlassian eligibility is checked before each Marketplace submission.

Reporting a vulnerability

Please email marcin@radrly.com with the subject [LeakRadar security], a description, steps to reproduce and the impact you see. Do not include customer data. We will acknowledge your report within 2 business days and keep you informed until it is resolved. Please give us reasonable time to fix the issue before disclosing it.