ScriptFree — Security Policy
Last updated: 26 August 2026
This covers the technical and operational security of the app — how it's built, hosted, and permissioned. For what happens to your data specifically, see the Privacy Policy.
Jump to a section
01 Platform & infrastructure
The app runs entirely on Atlassian's Forge platform (Node.js runtime) — there's no separate server, database, or hosting environment operated outside of Forge. All storage uses Forge's own Key-Value Store, and data at rest is encrypted by the Forge platform itself, not by anything this app implements.
Its one AI-assisted step — converting Groovy to Forge JavaScript — also runs through Forge's own built-in LLM API, rather than a separate third-party AI service this app connects to directly.
02 Least-privilege access
The app requests the following Jira scopes. Two of the four are used by the app's own code; the other two exist purely so the conversion tool can check generated code against a realistic permission baseline and warn you when it needs more than what's granted.
| Scope | Purpose |
|---|---|
| read:jira-work | Used directly — reading your site's custom-field catalog (name, ID, type only). |
| storage:app | Used directly — short-lived Key-Value Store entries (see the Privacy Policy for exact retention). |
| write:jira-work | Not called by this app's own code. Included as a baseline the conversion output is checked against. |
| read:sprint:jira-software read:board-scope:jira-software | Not called by this app's own code. Same reasoning — a baseline for Agile-API conversions. |
The app never requests delete or admin-level scopes, and never asks for anything beyond reading your site's field catalog and using its own short-lived storage.
03 Tenant isolation
Every piece of data this app stores is scoped to Forge's own per-installation storage. Nothing is pooled, compared, or made visible across different customers' Jira sites — each installation's cached field catalog, in-flight conversion, and usage counter is isolated to that installation alone.
04 Build practices
- Secret redaction before anything leaves your site. Pasted scripts and error logs are scanned for credential-shaped strings and redacted before the conversion request is even queued — not just before it reaches the AI model.
- No credentials generated blind. When converted code genuinely needs a third-party credential, the tool is instructed to have it read from a Forge environment variable and fail loudly if that variable is missing — never to fall back to a hardcoded or placeholder value that would silently make a bad-auth request.
- Field IDs are never invented. Custom-field references in converted code are grounded against your site's real field catalog, fetched live — not guessed or templated.
- No raw content in logs. Application logs cover operational events (a failed fetch, a timeout); they aren't used to persist the scripts or error logs you paste in.
- Prompt-injection resistant by design. Pasted content is explicitly treated as data to convert, never as instructions to the underlying model — tested against scripts that embed instruction-like text.
05 Reporting a security issue
If you believe you've found a security vulnerability in this app, please report it directly rather than filing a public issue.
- security@clipperitservices.co.uk
- Response target
- Acknowledgement within 2 business days
- Please include
- Steps to reproduce, and the impact you believe it has
We'll keep you informed as we investigate and work on a fix, and credit responsible disclosures if you'd like.
06 Policy changes
This policy is reviewed as the app evolves. Changes are reflected in the "Last updated" date at the top of this page.