Security
How Residual protects the data in your risk register.
Runs on Atlassian
Residual is built on Atlassian Forge and runs entirely on Atlassian infrastructure. Its code, its functions and its storage are hosted by Atlassian. MAKOA LLC operates no servers of its own for the app. Residual is eligible for the Runs on Atlassian program.
No egress
The app declares no external domains and makes no connections to systems outside Atlassian. Data never leaves your Atlassian cloud through the app. PDF and CSV exports are generated in the browser of the user who starts them.
Scopes
Residual asks for three scopes, each for a specific purpose.
| Scope | Why the app needs it |
|---|---|
storage:app | Stores registers, risks, assessments, treatments and audit events in Forge Custom Entities inside your Atlassian cloud. |
read:jira-work | Checks the permissions of the current user in the project and reads the project name for the report header. |
read:jira-user | Shows display names instead of account IDs for owners, assessors and the people in the audit trail. |
Residual has no write access to Jira. It creates no work item types, no custom fields and changes no permission schemes.
Permission checks as the user
Every request to the app checks the permissions of the signed in user in the Jira project (asUser). Jira's own permission scheme is the single source of truth:
- View the register: Browse projects
- Create, edit and assess risks, manage treatments: Edit issues
- Configure the register and delete risks: Administer projects
Details are in the documentation.
Audit trail
Every change to a risk, an assessment or a treatment is recorded with the person who made it, the time, the old value and the new value. Changes are recorded under the person's own account, never in the name of the app. Configuration changes and exports are recorded as well. The app never deletes audit events, also not when a risk is deleted.
Reporting a security issue
Please send security reports to support@makoa.ch. Please do not disclose the issue publicly until it is fixed.
We acknowledge every report within two business days. Confirmed vulnerabilities are fixed within the timeframes of the Atlassian Marketplace Security Bug Fix Policy, which is based on the severity of the issue. We tell you when the fix is released.
How we handle a security incident
MAKOA LLC follows a documented five step process for every reported vulnerability and every security incident affecting an app. The process is reviewed once a year.
- Acknowledge. Every report to support@makoa.chis acknowledged within two business days and recorded with the time it was received, the reporter and the affected app version.
- Assess. We reproduce the issue, determine which app versions and which customer data are affected, and assign a severity following the Atlassian Marketplace Security Bug Fix Policy.
- Contain and fix. We develop the fix, deploy it to the Atlassian production environment, and verify it on a test site before closing the report. Fixes are released within the timeframes the severity requires.
- Notify. If customer data or customer instances are affected, we inform the affected customers and Atlassian using the Atlassian security incident and vulnerability notification templates, within the timeframes set out in the Atlassian Marketplace Partner Agreement. Security incidents are also reported to Atlassian through the Marketplace partner security incident form.
- Review. After the fix is released we record the cause, the timeline and the corrective action, and we change the development process where the cause allows it.