Security & Vulnerability Management Policy

1. Zero-Egress Architecture & Infrastructure Security

All Neural Void Jira applications are built 100% natively on the Atlassian Forge serverless runtime and qualify for the official Runs on Atlassian trust badge.

• Zero External Data Egress: Our applications do not maintain external application servers, third-party databases, or external analytics endpoints. Compute operations execute entirely inside Atlassian-managed isolated serverless sandboxes.
• Isolated App Storage: Configuration parameters, sprint baselines, and project settings are stored exclusively in Atlassian Forge Key-Value Storage (KVS), partitioned and isolated per customer tenant.
• Encryption at Rest and in Transit: All customer data is encrypted in transit using TLS 1.3 and at rest using industry-standard AES-256 encryption managed directly by Atlassian Cloud / AWS infrastructure.
• Data Residency: All data storage automatically inherits your Jira instance's designated data residency region (EU, US, Germany, etc.). Customer data never crosses regional boundaries without explicit administrator configuration.

2. Application Security Controls & Least Privilege

We implement defense-in-depth principles to protect customer project data and permissions:

• User Context Enforcement (asUser): All read and write operations interact with Jira REST endpoints through the calling user context (asUser()), strictly respecting Jira project permissions and user roles.
• Administrative Authorization Gates: Mutating administrative settings or initiating Scope Swap operations strictly requires verified Jira ADMINISTER_PROJECTS privileges. Unauthorized requests are blocked at the resolver boundary.
• Anti-Injection & Sanitization: Input parameters and JQL queries undergo strict regular expression validation to prevent JQL injection. CSV data exports enforce formula injection escaping against DDE attacks.
• SSRF Protection: Outbound webhook testing resolves target hostnames and enforces strict blocking of loopback addresses (127.0.0.0/8), RFC 1918 private subnets, and cloud metadata IPs (169.254.169.254).

3. Vulnerability Management & Patching SLA

Neural Void maintains proactive vulnerability management to discover, assess, and remediate security issues continuously:

• Automated Scanning: Automated scans via Atlassian Ecoscanner, npm audit, and automated static application security testing (SAST) run prior to every production release.
• Dependency Hygiene: Third-party dependencies are pinned to verified versions and scanned against the National Vulnerability Database (NVD).

Deployments on Atlassian Forge Cloud are executed serverless-side with zero customer downtime and immediate propagation across all cloud instances.

4. Security Incident Management & Notification Procedure

In the event of a suspected or confirmed security incident:

1. Triage & Containment: The incident response team immediately isolates the affected module and deploys hotfix mitigations to the Forge production environment.
2. Customer Notification (24h SLA): If an incident poses any risk to tenant configuration or security boundaries, Neural Void will notify affected administrators and Atlassian Security within 24 hours of incident confirmation.
3. Root Cause Analysis (RCA): A comprehensive Root Cause Analysis detailing findings, timeline, and corrective actions will be published within 5 business days.

5. Responsible Disclosure & Security Contact

We welcome responsible security reports from researchers, partners, and customers. If you believe you have discovered a vulnerability, please contact us immediately: