Blocker Triage security and data

Architecture and permissions

Blocker Triage is a read-only Jira Cloud project page built with Atlassian Forge UI Kit. It uses the read:jira-work scope to read issue-link types, open project work and linked issue details. Requests run as the interacting user; Jira browse permissions and issue security determine the information returned. Missing linked details are omitted. The app requests no Jira write or administration scope.

Scope and data

The queue covers one project, one selected relationship direction and one hop. It processes visible issue identifiers and summaries, work types, statuses/categories, assignee display names and account identifiers, priority labels/identifiers, creation/update timestamps and issue-link metadata. Scans are bounded to 500 project items and 500 selected linked keys. Warnings identify capped subsets; incomplete pagination produces an error. Completed blockers are excluded.

In-memory validity

Queue results and reusable linked-detail cache entries have an absolute 15-minute validity limit from scan start. Filters and relationship changes do not extend this limit. Expired application state/cache is cleared when JavaScript executes; expired results are refused on resumed renders, user actions and request completion. A new scan is required rather than an automatic background refresh. A browser or device can suspend JavaScript and retain memory until execution resumes, so the validity limit is not a guarantee of physical erasure during suspension.

Storage, logging and transfers

Reviewed app runtime has no external backend, remote database, app-owned Jira-content/configuration storage, external egress domains, analytics, advertising or AI processing. App code does not intentionally write issue content, credentials or access tokens to application logs. Jira and Forge may process operational information under Atlassian's agreements.

Support email is separate from this runtime. Namecheap Private Email processes support correspondence, which may be processed outside the UK or EEA. See the privacy notice for the support provider, retention and rights information. App no-egress statements do not apply to separately sent support email.

Preparation status

The app candidate remains in preparation and is not advertised as available on Marketplace. Local source checks do not certify native Jira rendering, restricted-user authorization or paid-production license behavior. No current platform eligibility badge or completed customer release validation is claimed. Production access is designed to require explicitly active license metadata.

Security reports

Email support@kitawolfstudios.com with the subject Blocker Triage security report. Send impact and safe reproduction details without passwords, tokens or unnecessary customer information. The support policy sets the two-business-day acknowledgement target; it is not an SLA guarantee.