Secret & PII Scanner for Confluence and Jira

Privacy and data handling

In short, the app reads page, blog post and issue text inside Atlassian's cloud, keeps only masked findings in Forge storage, and sends nothing anywhere else.

What the app reads

• In Confluence, the title and body (storage format) of pages and blog posts, when they are created or edited, and during an admin-started space scan.
• In Jira, the summary, description, environment and up to 100 comments of an issue, when it is created, edited or commented on, and during an admin-started project scan.
• Background reads run as the app (asApp). Content the app cannot see is not scanned.

What the app stores (Forge KVS, hosted by Atlassian)

The app stores these items for each page, blog post or issue with findings. Clean content leaves no record.

• content id, type, title (pages and blog posts) or issue key (issues; the summary is not stored as a title), space or project key, relative link, scan time;
• for each finding, the detector, severity, field (e.g. body, comment 10234), line number, the masked value (for example ghp_…3z5A, ** 6467, j@a**.io), up to 24 characters of text before the value (long tokens, credential-like runs, digit groups and values after credential keywords in that text are replaced by …; this is a filter, and a credential made only of lower-case letters, with no keyword or after an all-lower-case run-together keyword such as dbpassword, can remain; values after camelCase, PascalCase or upper-case keywords such as dbPassword, JWTSecret or PGPASSWORD are replaced), an occurrence count, and the time it was marked false positive (if it was).

The app also stores settings, the state of the last scan job, and one random 256-bit secret per installation (used only to compute finding ids, see below).

The full secret or personal value is never stored. Finding ids are SHA-256 hashes of product, content id, field, detector and a keyed fingerprint of the value (HMAC-SHA256 with the installation's random secret). The fingerprint lets the app tell two different secrets apart without storing either; without the installation's secret it cannot be matched to a value.

The app stores no Atlassian account IDs and no user names.

Retention

• A record is replaced on every rescan and deleted when the content no longer has findings, when a Jira issue is deleted, when the content returns "not found" on rescan, or when a full space/project scan no longer sees it.
• Uninstalling the app removes its Forge storage (Atlassian platform behaviour).

Who can see findings

Only Confluence administrators (on the Confluence admin page) and users with the Administer Jira permission (on the Jira admin page). The app checks this as the calling user on every request and refuses if the check fails. It also checks, as that admin, which pages and issues they can open; findings in content they cannot open are left out of the list, totals, counts and CSV export.

Egress

None. The manifest has no permissions.external, no remotes and no fetch targets. All calls go to the Confluence and Jira REST APIs of the same site through Forge's requestConfluence / requestJira.