Security Policy

Architecture

Sprint Autopilot for Jira is built on Atlassian Forge, Atlassian's serverless app runtime. The app runs entirely within Atlassian infrastructure. There are no external servers, no third-party services, and no data routing outside of your Atlassian site.

Data handling

• Sprint and board data is read via the Jira Agile API. Scheduled actions use the app account within the scopes granted at installation.

• Sprint detail updates made through the panel execute as the logged-in user, enforcing their Manage Sprints permission.

• Per-board configuration is stored in Forge KV Storage, scoped to the app, and never leaves Atlassian infrastructure.

• Issue data (keys and resolution status) is accessed only when closing a sprint to move unresolved issues. No issue content is stored.

• No data is sent to any third-party service or external endpoint.

Permissions

The app requests the minimum permissions required:

• read:board-scope:jira-software read board and backlog information

• read:sprint:jira-software read sprint details and sprint issues

• write:sprint:jira-software start and close sprints, move issues between sprints, create new sprints

• write:board-scope:jira-software move issues to the backlog

• read:project:jira look up board information

• read:issue-details:jira read issue fields when fetching unresolved issues

• read:jql:jira query for unresolved issues in a sprint

• storage:app store per-board settings in Forge KV Storage

User context

Sprint detail updates (name, dates, goal) are performed using asUser(), meaning they execute with the permissions of the logged-in user. The app cannot update a sprint on behalf of a user who does not have Manage Sprints permission. Automated actions (auto-start, auto-close, auto-create) use asApp() within the scopes listed above.

Reporting a security issue

If you discover a security vulnerability, submit a ticket. We will acknowledge within 2 business days and aim to resolve confirmed issues within 14 days.