Security Policy

Last updated: 28 October 2026 Security contact: [email protected]

How the app is built

• Gherkin Studio is an Atlassian Forge app. Its code runs on Atlassian's Forge platform, and its screens run in Atlassian's sandboxed frame inside Jira.
• We run no servers and no database of our own. Scenarios, settings and test results are kept in Forge storage on your Atlassian site.
• The app can contact only the four hosts declared in its Forge manifest: api.github.com, gitlab.com, api.bitbucket.org and api.anthropic.com. It contacts them only after an admin turns on Git sync (project admin) or AI drafts (Jira admin). Forge blocks every other address.
• What data is stored, what leaves Atlassian and when is described in the privacy policy.

Access control

• Every request checks the signed-in user's Jira permissions before reading or writing:
  • reading scenarios needs permission to browse the issue;
  • saving, syncing and AI drafts need permission to edit the issue;
  • Git settings need project admin;
  • AI settings, the CI token and import need Jira admin.
• The issue and project come from Atlassian's request context, not from data sent by the browser.
• Issue text for an AI draft is read as the signed-in user, so the AI never sees an issue that user cannot see. Only the person who asked can open the draft.

Secrets

• Git access tokens and the Anthropic API key are kept in Forge's encrypted secret storage. They are never sent back to the browser and never written to logs.
• The CI token is 32 random bytes, shown once. We keep only its SHA-256 hash and compare it in constant time.
• Admins can delete the Git token (Disconnect), delete the AI key, and replace the CI token at any time.

The CI test report address

• It accepts only HTTPS POST requests with a valid CI token and a Cucumber JSON report of at most 5 MB.
• One report can update at most 500 issues, and only the test status of issues that exist on your site. It cannot change scenarios.
• Build links are accepted only as https:// addresses.
• There is no rate limit of our own beyond Forge's platform limits. If a token leaks, replace it on the app's admin page.

Safe handling of content

• The app shows all user text as plain text; it never inserts it as HTML.
• Git settings accept only safe repository, branch and folder names.
• Git writes are conditional, so the app never silently overwrites a newer file in your repository, and it never deletes files there.
• Scenario text with Gherkin errors is never pushed to Git.

Dependencies

• Production dependencies are checked with npm audit. Last result: 0 known vulnerabilities (28 October 2026).

Logs

• The app writes to Forge logs, which Atlassian hosts. Logs contain issue and project keys and error messages. They do not contain scenario text, tokens, API keys or account IDs. We share logs with no one.

Reporting a security problem

• Email [email protected] with "Security" in the subject. Please do not include working tokens or keys.
• We aim to acknowledge within 4 support hours (Monday to Friday, 09:00–18:00, Europe/Bucharest time).
• We assess the report, fix it, release the fix through Atlassian, and tell affected customers. We follow the timelines of Atlassian's Marketplace Security Bug Fix Policy.

What we do not have yet

• No compliance certifications (such as SOC 2 or ISO 27001) and no independent penetration test of this app.