Deadline Guard for Jira

Security Policy

Last updated: 10 August 2026

This Security Policy explains the security architecture, controls, vulnerability management, incident handling, and reporting process for Deadline Guard for Jira, provided by FunAMP (合同会社FunAMP).

Security architecture

• The app is hosted on Atlassian Forge and is eligible for Runs on Atlassian.
• The app has no external server, does not use Forge Remote, and has no external data egress.
• Project business-calendar settings are stored in Forge hosted storage using the Forge Key-Value Store.
• The app uses the Jira and Forge scopes required for its documented features: read:jira-work, write:jira-work, and storage:app.

General security controls

• Least privilege is applied to Forge scopes, Jira actions, and project-settings administration.
• Jira evaluates the current user's permissions for issue reads and due-date updates. Backend resolvers validate settings input and verify project-administrator permission before saving changes.
• Dependencies are managed through npm and reviewed with npm audit. Automated tests, linting, type checking, and Forge manifest linting are run before release changes.
• Credentials, API tokens, and other secrets must not be stored in source code. Application errors and logs are designed not to expose secrets or unnecessary customer information.
• Production changes are verified through the project's test and validation workflow before deployment.

Vulnerability management

FunAMP reviews application dependencies and known vulnerability reports, including results from npm audit. Critical and High severity findings are prioritized for investigation and remediation. We also review available updates and security information for upstream dependencies such as Atlassian Forge and Atlaskit packages.

When a vulnerability report is received, FunAMP validates the report, assesses whether Deadline Guard is affected, determines an appropriate remediation, and verifies the resulting change before release. We do not publish a fixed remediation SLA.

Security incident handling

FunAMP's incident process includes receiving and triaging the report, assessing impact, containing the issue where applicable, implementing and verifying remediation, and reviewing the incident after resolution. When notification is appropriate or required, FunAMP will coordinate with affected users and Atlassian based on the nature and impact of the incident.

Report a security issue

Send suspected security issues to imai@funamp.jp. Include the affected feature, steps to reproduce, expected and observed behavior, and any non-sensitive diagnostic detail that helps us investigate.

Use the Support page for installation, configuration, licensing, and general product issues. Use the security contact above for suspected vulnerabilities or security incidents.

Data handling

The app does not store names, email addresses, Atlassian account IDs, usernames, IP addresses, or personal activity history in app storage. It stores only project business-calendar settings, including weekly non-working days, custom holiday dates, timezone, and due-date counting mode. The app does not automatically transmit app data to an external service.

For retention, support communications, and other privacy details, see the Privacy Policy.