Worklog Viewer

Worklog Viewer

Security Policy

Last updated 12 August 2026

Worklog Viewer is built to have as small an attack surface as possible, by design rather than by policy. This page explains why, what we ask of you, and how to report a problem.

Reporting a vulnerability

If you believe you've found a security issue, please email hello@tomasz.fr with details and, if possible, steps to reproduce. Please report privately rather than filing a public issue.

We aim to acknowledge reports within 5 business days, and we will not pursue legal action against good-faith security research conducted under this policy.

Why the attack surface is small

By construction, this app:

  • Runs entirely on Atlassian Forge (Custom UI) — there is no server of our own to secure, patch, or misconfigure
  • Never asks for or stores API tokens, passwords, or any other shared secret — authentication happens automatically through Forge's own bridge
  • Has no external network egress — it only talks to Jira, through @forge/bridge, and calls no third-party service
  • Is eligible for Atlassian's Runs on Atlassian program, which independently certifies exactly this

Permissions requested

The app requests the following Jira scopes, each used for exactly one purpose:

read:jira-work
Read issues, projects, and worklogs for the timesheet and calendar views.
write:jira-work
Create, edit, and delete your own worklogs from within the app.
read:jira-user
Identify the signed-in user, so the app only shows and filters that user's own worklogs.

Data handling

See the Privacy Policy for full details. In short: there is no backend and no database — the only thing stored outside of live Jira data is a small, non-personal cache of filter preferences in your own browser.

Supported versions

Only the latest version published on the Atlassian Marketplace is supported. Fixes ship as new versions rather than being backported to older ones — Forge apps update automatically, so most customers are always on the latest version.

Contact

Security issues: hello@tomasz.fr. General questions: see Documentation.