Security

Saguaro Hours for Jira runs entirely on Atlassian Forge.

• Hosting. The app's code and data run on Atlassian's infrastructure. Its data sits in Forge hosted storage, in the same location as your Jira site. The app declares no external network access, so it cannot send data outside Atlassian.
• Access. We do not have routine access to your stored data. Every server call checks permissions: Jira administrators for settings, teams, import and export, and team leads or administrators for approvals.
• Dependencies. We audit the app's dependencies before each release and fix known high and critical issues before shipping.
• Personal data. The app reports stored account IDs to Atlassian's personal data reporting service and removes the data of closed accounts. See the privacy policy.
• Certifications. The app has no security certification of its own, no penetration test and no bug bounty.

Reporting a vulnerability

Email tyler@leducsystems.com with "Security" in the subject. Include the steps to reproduce and the affected version. We reply within 1 business day, and within 24 hours for anything that exposes customer data. Please give us a reasonable time to fix an issue before you disclose it publicly.