Security

Security Policy

Last updated: August 16, 2026 · Applies to all apps published by George Grachev

This Security Policy describes the measures taken by George Grachev ("Developer") to protect the security of applications published on the Atlassian Marketplace and the data processed by those applications. For security concerns or vulnerability reports, contact [email protected].

1. Scope

This policy applies to all Atlassian Marketplace applications developed and maintained by George Grachev, including Billview — Time Tracking, Timesheets & Worklog Reports for Jira.

2. Platform Security

All apps are built on Atlassian Forge, a secure serverless platform managed by Atlassian. This means:

No external servers or databases are operated by the Developer
All data is stored exclusively in Atlassian Forge Storage
Encryption at rest and in transit is provided and managed by Atlassian's infrastructure
Authentication and authorization are handled by the Forge platform

3. Principle of Least Privilege

Apps request only the minimum API permissions (scopes) required for their functionality. No additional scopes are requested speculatively. All Jira API calls use api.asUser() — requests are made on behalf of the authenticated user and respect their existing Jira permissions.

4. Data Protection

No personal data is stored outside Atlassian infrastructure
No personal data is shared with third-party services
Sensitive information (credentials, tokens, PII) is never written to logs
Admin-only operations are protected by server-side Jira permission checks

5. Input Validation

All user-supplied inputs are validated before use:

Issue keys and account IDs are verified for presence and format
Date fields are validated against a strict regex to prevent JQL injection
Array inputs are type-checked before processing
Account IDs are always taken from the server-side Forge context, never from user payload

6. Secure Export

CSV export functionality is secured by short-lived, single-use tokens: cryptographically random (48 hex characters), stored in Forge Storage, valid for 5 minutes, and deleted immediately after first use. Requests without a valid token are rejected with a 401 error.

7. Dependency Management

Third-party dependencies are reviewed regularly using npm audit. Known vulnerabilities are patched in accordance with the Atlassian Marketplace Security Bug Fix Policy. Dependencies are kept minimal to reduce attack surface.

8. Incident Response

In the event of a security incident:

Affected customers will be notified within 72 hours of discovery
Atlassian will be notified via the Marketplace support portal
The app may be taken offline if necessary to prevent further impact
A post-incident summary will be provided to affected customers

Incident notifications follow the Atlassian Security Incident Management Guidelines.

9. Workstation Security

Multi-factor authentication (MFA) is required for all development accounts
Operating systems and development tools are kept up to date
Anti-virus / endpoint protection is active on all workstations

10. Reporting a Security Issue

If you have discovered a security vulnerability in any of our apps, please report it responsibly:

Email: [email protected]
Subject line: Security Vulnerability Report — [App Name]
Please include a description of the vulnerability, steps to reproduce, and potential impact
We will acknowledge your report within 2 business days and provide a resolution timeline

We kindly ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and address it.