Parent Pulse security and data

Architecture

• Jira Cloud app built entirely on Atlassian Forge
• UI Kit issue panel rendered inside Jira
• Jira API calls execute as the interacting user
• No Forge Remote, web trigger, external backend, external database, or external data-egress domain
• No third-party analytics, advertising SDK, AI processing, or customer tracking

Permissions

Parent Pulse requests only read:jira-work. It reads the current parent's visible direct children and the minimum fields needed for status, time, and estimate rollups. It requests no Jira write or administration scopes.

Data handling

Rollups are calculated on demand and displayed to the requesting user. The app does not persist issue content or write results back to Jira. Jira browse permissions and issue security remain authoritative.

Development practices

• Automated domain and licensing tests
• Forge lint validation
• Software-composition analysis with npm audit
• Dependency updates reviewed against current official Forge packages
• No secrets committed to the repository
• Security and privacy facts reviewed before Marketplace submission

Reporting a vulnerability

Email support@kitawolfstudios.com with the subject Parent Pulse security report. Include reproduction steps and impact, but do not send live credentials, tokens, or unnecessary customer data. We will acknowledge reports within two business days and coordinate remediation and disclosure according to severity and Atlassian Marketplace requirements.