Security

Reporting a vulnerability

Please report security problems in Expiry Tracker or its SSL agent by e-mail to security@flowsmiths.app. Do not open a public issue for a vulnerability.

Include, if you can: what you found, how to reproduce it, and which Jira site type (Cloud) and app version are affected. Do not include real customer data.

What to expect:

• an acknowledgement within 2 business days;
• an assessment and a planned fix date within 7 days;
• fixes within the timelines of Atlassian's security bug fix policy for Marketplace cloud apps, by severity, counted from when we confirm the problem;
• credit in the release notes if you want it.

We will not take legal action against good-faith research that respects the privacy of others, avoids data destruction and service disruption, and gives us reasonable time to fix a problem before disclosure.

Scope

• The app "Expiry Tracker" for Jira Cloud
• The SSL agent script

Out of scope: the Atlassian platform itself (report to Atlassian), and domain registries' RDAP services.

If something goes wrong on our side

1. Confirm and contain: disable the affected function or roll back the deployment (forge deploy of the last good version).
2. Assess what data could be affected. The app stores data only in Forge Storage per installation.
3. Notify Atlassian through the partner security channel and affected customers without undue delay, with what happened, what data is involved and what they should do (for example replace the agent token).
4. Fix, add a regression test, and publish what was changed.