Scenario Book for JiraSecurity
How it is built
- Runs on Atlassian. Built on Forge, with no servers of our own and no outside calls. The platform itself refuses any call the app hasn't declared, and it declares none.
- Your permissions, checked as you. Every screen that reads a project's data checks, as you, on every call, that you can browse that project. Editing, deleting or restoring scenarios checks that you can edit each story they belong to; moving or renaming files checks that you can edit issues in the project. Project settings need project admin (or Jira admin), and the app's admin page needs Jira admin. The app never gives anyone more than Jira does.
- Two inbound addresses, for your pipeline only. Each call needs a sync key for that one project. Keys are stored only as a hash and compared in constant time; revoked keys are refused like wrong ones; each key is limited to one call every 5 seconds; bodies over 4 MB are refused. The addresses answer only with fixed messages and never return data.
- Nothing renders as HTML. Scenario text is always shown as text, never as markup.
- Checked input. Feature files are read with the Gherkin parser and refused if unreadable; zips are opened in your browser with size limits per file and per import; paths that climb out of a folder are refused; files in an encoding other than UTF-8 are refused, not altered.
- Logs carry ids and counts only. Never scenario text, file names or story summaries.
- Tested permission checks. Each of 126 checks is tested by deleting it or making it always allow, and confirming a test fails.
What the app may do in Jira
| Permission | Why |
|---|---|
Read Jira work (read:jira-work) | Read the stories scenarios belong to (type, status, fix versions), check your browse and edit permission as you, and read the app's own project properties. |
Write Jira work (write:jira-work) | Write the counts-only property on a story so JQL can find it. Nothing else on a story is changed. |
Manage projects (manage:jira-project) | Write project properties and nothing else about a project: only while pipeline sync is on, so your pipeline can read the project's feature files. |
App storage (storage:app) | Store your feature files, versions, results and settings in Atlassian's Forge storage. |
Personal data reporting (report:personal-data) | Tell Atlassian weekly which account ids the app holds, and erase closed accounts. |
Not requested: reading user profiles. That is why the app says "a teammate" instead of a name.
Credentials
Scenario Book never asks for your Jira API token, Git credentials or Behave Pro credentials. Your pipeline holds those. The only secret the app handles is a sync key it creates for you, shown once and stored as a hash.
Reporting a vulnerability
Email hello@goldstandardweb.com with "Security" in the subject. We follow Atlassian's security bug fix policy and its incident process, and tell affected customers within 72 hours of confirming an incident that affects them.