Loomwise Security Policy
Last updated: November 5, 2026
This policy describes how Loomwise secures its Atlassian Marketplace apps (Loomwise Default Field Values, Loomwise Private Comments and other Loomwise Jira apps, the "Apps"), how we handle security incidents, and how to report a vulnerability. Loomwise is a small independent vendor; the controls below are scaled to that, and we rely on Atlassian Forge for hosting.
Architecture
- The Apps are built on Atlassian Forge and run entirely on Atlassian's infrastructure ("Runs on Atlassian"). They use Forge UI only.
- The Apps make no calls to external hosts and send no data outside Atlassian. Loomwise operates no servers or databases that hold customer data.
- Configuration is kept in Forge app storage, hosted by Atlassian in your site's data residency region. Data is encrypted in transit and at rest by Atlassian.
- Each App requests only the Forge scopes it needs to function, and acts with the permissions Atlassian grants it.
Security controls
- Access control: only Loomwise maintainers can access the developer, Marketplace and source accounts. These accounts use unique strong passwords from a password manager and two-step verification where available.
- No customer data access: Loomwise staff cannot read data in customer Jira sites. We never ask customers for credentials.
- Secure development: source code is version controlled, changes are reviewed before release, and releases are deployed only through the Forge CLI. Secrets are never committed to source.
- Dependency management: dependencies are kept minimal and scanned regularly (npm audit) for known vulnerabilities. Atlassian Forge platform packages are updated as new versions are released.
- Backups: source code is backed up to multiple locations so releases can be rebuilt.
- Platform security: we follow Atlassian's Forge security requirements and the Marketplace Security Bug Fix Policy, and participate in Atlassian's security requirements for cloud apps.
Vulnerability management
- Please report suspected vulnerabilities to hello@loomwise.app with "Security" in the subject. Include steps to reproduce if possible. Please do not test against sites you don't own or access other people's data.
- We acknowledge reports within 2 business days and keep the reporter informed.
- Fixes follow the Atlassian Marketplace Security Bug Fix Policy timelines: Critical within 2 weeks, High within 4 weeks, Medium within 6 weeks, Low within 25 weeks.
- Vulnerabilities reported through Atlassian (including the Marketplace bug bounty and ECOHELP security tickets) are handled the same way.
- We will not take legal action against good-faith security research that follows this policy.
Incident handling
- Detect and triage: we monitor reports, Atlassian notices, and developer console alerts, and assess severity and affected customers.
- Contain: where needed we disable affected functionality, deploy a fix through Forge, or rotate credentials.
- Notify: if customer data is affected, we notify Atlassian and affected customers without undue delay, and no later than 72 hours after confirming the incident, with what happened, what data was involved, and what we are doing about it.
- Recover and review: we confirm the fix, restore normal service, and document root cause and preventive steps.
Related policies
Jira app privacy policy · Jira app terms