Security Policy for Release Management, Roadmaps & Product Portfolio for Jira and Vulnerability Reporting Guidelines
Scope
This policy applies to the Release Management, Roadmaps & Product Portfolio for Jira app and its released Forge app artifacts.
Supported Versions
Security fixes are provided for the most recent maintained release line.
Version line | Supported |
|---|---|
Latest released minor/patch version | ✅ |
Older release lines | ❌ |
Reporting a Vulnerability
If you believe you have found a security vulnerability, please report it responsibly by emailing support@divim.io with the subject "Security Vulnerability Report — Release Management, Roadmaps & Product Portfolio for Jira".
When reporting, include:
A short description of the suspected issue.
Affected component(s) and app version, if known.
Reproduction steps using sanitized or synthetic data.
The potential impact.
Coordinated Disclosure
To protect users, please do not publicly disclose exploit details until we confirm a fix is available.
What to Avoid in Reports
To reduce risk and prevent accidental exposure, do not include:
Secrets, tokens, credentials, or API keys.
Customer-identifying data or private Atlassian tenant details.
Full exploit payloads that could be reused against production systems.
Response Expectations
We will:
Acknowledge receipt of a security report as soon as practical.
Triage and validate the report.
Communicate status updates during remediation.
Publish a fix and disclosure summary when appropriate.
Security Principles
This app follows these baseline security practices:
Least-privilege Jira scopes.
Input validation and safe API request patterns.
No hard-coded credentials.
Dependency and code review checks in the development workflow.