Form Drift Check
by ProfitSignal Labs

8 OCTOBER 2026 · VERSION 1.0

Partner Security Policy

This policy describes the security controls and security-report handling for Form Drift Check for JSM, provided by Jon Ander Irazusta Iribar, trading as ProfitSignal Labs. It covers the Forge app and the provider's handling of related support and security reports. The Privacy Notice separately explains personal-data processing and retention; the customer terms govern the service.

Report a security issue

Contact support@profitsignallabs.dev with the subject “Security — Form Drift Check”, or use our support portal. Include the affected app version, approximate time, impact and minimal reproduction steps using synthetic or redacted data. Do not send passwords, API tokens, full Jira exports or private customer records. If further evidence is needed, we will agree an appropriate channel and limit it to what the investigation requires.

Our general initial-response target is 24 hours. Support hours are Monday–Friday, 09:00–18:00 Europe/Madrid. Contractual response commitments remain 24 hours for requests Atlassian designates critical and five business days for other requests. These are response commitments, not guaranteed resolution times or a claim of continuously staffed monitoring. The provider is responsible for coordinating security reports and communications with Atlassian.

Application controls and access

Data protection and related systems

Raw form answers, Jira field values, titles and free-text reasons are not persisted by the app. Forge storage holds project rules and bounded review metadata, including account IDs, identifiers, classifications, dates and keyed fingerprints. Fingerprints use a per-installation secret stored through Forge secret storage; this secret is not returned to the browser. History becomes unavailable after 30 days and is scheduled for platform deletion; physical deletion may lag. Rule versions do not expire automatically. See the Privacy Notice for assisted deletion and platform retention limitations.

Atlassian operates the app runtime, Jira APIs and Forge storage; infrastructure security is provided by that platform. ProfitSignal Labs is responsible for its application code, permission choices, configuration and release decisions. This is not a claim that Atlassian has certified or penetration-tested our app.

The documentation website uses Sites hosting; support uses Porkbun email and Atlassian Jira Service Management. These channels are separate from the app's Jira processing: the app does not automatically copy Jira content into support requests. Security investigations use minimal, redacted evidence. Temporary contributor access used for testing is limited to the relevant app and removed after the test; production log access and broader Jira permissions are not granted as part of that routine.

Vulnerability management and release checks

We use dependency vulnerability checks and review their results as part of release preparation. Findings and reports are assessed for affected versions, exploitability, permissions required and potential customer impact. Confirmed vulnerabilities are prioritized by severity and addressed under the applicable Atlassian Marketplace Security Bug Fix Policy. A dependency update or code correction is tested before release; a report is not considered resolved merely because a change was proposed.

For the submitted candidate, release evidence includes 176 automated checks, linting and bounded synthetic cloud checks of owner access, secondary-account denial, cross-site separation, rules, history and export rereads. A production-dependency audit on 28 September 2026 reported no known vulnerabilities at that time. This historical result is not a current scan or a guarantee that no vulnerability exists. We do not claim an independent penetration test, security certification, continuous automated scanning or exhaustive load testing.

Security incident handling

  1. Assess and record: review the report, validate it safely, identify affected versions and installations where possible, and record the evidence and impact without collecting unnecessary customer content.
  2. Contain: determine a proportionate mitigation with the affected customer and Atlassian when platform action is needed. Depending on the issue, this may involve restricting an affected function or advising a temporary workaround. Avoid destroying evidence or exposing further data.
  3. Communicate: notify Atlassian and affected customers of confirmed security incidents or critical app vulnerabilities, using the applicable Marketplace incident process and contractual or legal notification requirements. Share known impact, available mitigation and the next update; clearly identify facts still under investigation.
  4. Remediate and verify: correct the cause, test the fix and permission boundaries, release through the appropriate process and communicate the affected and corrected versions.
  5. Review: document the cause, response and follow-up prevention measures. Keep investigation material limited to the security and legal need described in the Privacy Notice.

Reports should be coordinated privately while a vulnerability is assessed and corrected. This policy does not establish a paid bug-bounty program or authorize testing against other customers' data or systems.

Policy updates

We update this page when relevant security practices change. Material changes to processing or customer commitments are also reflected in the Privacy Notice or customer terms as applicable. Last updated: 8 October 2026.