Security Statement

CodeDoc for Confluence · Last updated: October 12, 2026

1. Overview

CodeDoc for Confluence ("the App") is built on the Atlassian Forge platform and follows the principle of minimal data access, zero external infrastructure, and user-controlled credentials. This document describes the security architecture, data protection measures, and operational practices of the App.

2. Architecture & Runtime Environment

The App runs entirely within Atlassian's Forge runtime:

• No developer-operated servers: There is no external backend, database, or infrastructure operated by us. All compute and storage is hosted by Atlassian.
• Sandboxed execution: Forge functions execute in isolated, sandboxed containers with restricted system access.
• Network isolation: Outbound network requests are restricted to domains explicitly declared in the App's manifest and to own Git servers that a site admin approved for your site (see section 5). The App cannot make arbitrary network calls.
• Atlassian AI (Advanced edition): AI pages use Claude models hosted on Atlassian's platform (Forge LLMs) unless an own AI key is connected and chosen in Settings. No AI key is involved, the code is not sent to a third-party AI provider, and every request is checked against the site's monthly allowance before it starts.
• No ingress: The App does not expose any endpoints to the public internet except a Forge webtrigger URL for Git webhook events (validated and scoped).

3. Credential Management (BYOK)

The App operates on a Bring Your Own Key model. Users provide their own access tokens (Git providers) and, unless AI pages use Atlassian AI in the Advanced edition, their own API keys (AI providers). These credentials, and the webhook secret, are handled as follows:

4. Data Protection

Data in transit:

• All communication between the App and external services (Git providers, AI providers) uses TLS encryption (HTTPS only).
• The App rejects non-HTTPS Git provider URLs at configuration time.
• Forge-to-Confluence API calls use Atlassian's internal secured transport.

Data at rest:

• Sensitive credentials: Encrypted at rest via Forge secret storage, managed by Atlassian.
• Configuration data: Stored in Forge app storage within the customer's Confluence instance.
• Source code: Never stored. Fetched on demand, processed in memory, and discarded after each job execution.

Data minimization:

• The App only accesses the minimum data needed: source code files (read-only), Confluence space/page metadata (for publishing).
• Generation history stores only metadata (job name, status, timestamp, token count, repository names, the paths of up to 50 files read) — no source code or documentation content.
• Webhook deduplication stores only SHA-256 hashes of delivery IDs and request bodies (kept for up to 7 days), not payload content.

5. Network Security & Allowlisted Domains

The App's Forge manifest declares the following external domains, without wildcards. Outbound requests are only possible to these domains and to own Git servers approved as described below — no other network communication can occur:

Own Git servers: GitHub Enterprise and GitLab self-managed servers are not in the manifest. When a CodeDoc admin connects one, Atlassian asks a site admin to approve exactly that server address (customer-managed egress); the approval is kept by Atlassian and shown in Atlassian Administration. Without it, Forge blocks every request to the server.

Atlassian AI needs no entry: Forge LLMs run on Atlassian's platform.

IP blocking: The App validates Git provider URLs and blocks connections to private, reserved, and loopback IP ranges to prevent SSRF attacks.

6. Authentication & Authorization

• Confluence access: Uses Atlassian Forge's built-in OAuth. User-initiated actions run with the user's permissions (api.asUser()); background jobs run with app-level permissions (api.asApp()).
• Minimal API scopes: The App requests only the scopes it needs: storage:app, read:space:confluence, search:confluence, read:page:confluence, write:page:confluence, delete:page:confluence, read:confluence-user, read:confluence-groups.
• Webhook verification: CodeDoc admins create a webhook secret in Settings → Webhook; the secret is required. The App accepts only webhook calls that carry it (GitHub, GitHub Enterprise and Bitbucket: HMAC-SHA256 signature; GitLab: secret token; Azure DevOps: basic authentication password), compared in constant time over the original request body (at most 5 MB), each provider only with its own method. Without a secret no webhook call is processed (HTTP 403) and the settings page shows Secret missing. Repeated deliveries do not start a second run.
• The user's own permissions before app writes: AI pages are written by the app user, because scheduled and webhook runs have no user. Before the App acts for a person, it checks that person's own Confluence permissions with Confluence's permissions API, called as that person: creating or changing an AI page needs permission to create pages in the target space and access to the parent page; publishing, discarding and manual runs check the target, the draft and the published page; undoing a run needs edit permission on the page; replacing a page of the same name needs edit and delete permission on it, also when CodeDoc created that page. Sync blocks are approved and synced on demand only by someone who may edit the page, and the block list shows only blocks on pages the person can see. Title searches and the group picker run as the person. If a check cannot be completed, the action does not run, and no answer is kept for the next request.

7. Input Validation & Output Safety

• URL validation: Git provider URLs must be HTTPS and are checked against private IP ranges.
• Repository paths and branches: File paths and branch names with ../ parts (also percent-encoded, also as a folder name inside the repository), backslashes or control characters are refused before any request, so a sync block or AI page reads only its own connected repository.
• Credential files: Environment files, Terraform state and variable files, package manager credentials, private keys and key stores, and credential or secret files are never sent to an AI provider, whatever the include patterns of an AI page say.
• Time limits: Reading a file into a sync block and applying include/exclude patterns stop after 8 seconds with a message, so a complex regular expression or pattern cannot block the App.
• Content sanitization: AI-generated documentation passes through a multi-layer XML validation and repair pipeline before publishing to Confluence, preventing malformed content from being injected.
• Token budget limits: File fetching is bounded by configurable token budgets (~120,000 tokens) and content size limits (~1 MB) to prevent resource exhaustion.
• Webhook deduplication: Duplicate webhook events are detected and rejected to prevent replay-style abuse.

8. Dependency Management

• Runtime dependencies are Atlassian's official Forge packages (@forge/api, @forge/bridge, @forge/events, @forge/kvs, @forge/llm, @forge/metrics, @forge/react, @forge/resolver), maintained by Atlassian, plus react, marked (reading Markdown files for sync blocks) and yaml (reading YAML files for sync blocks).
• Build and development tooling is not shipped in the production runtime.
• We run npm audit before every deploy via an automated pre-deploy gate that blocks a release on high or critical findings, plus a weekly automated audit.

9. Vulnerability Management

• We monitor for security issues in the App and Forge platform updates.
• Security patches are deployed promptly via Forge's deployment mechanism.
• The Forge runtime is maintained and patched by Atlassian, including the Node.js environment.

10. Incident Response

If a security issue is discovered in the App:

• We will investigate and remediate promptly.
• Affected customers will be notified via the Atlassian Marketplace listing and/or direct contact.
• Fixes will be deployed as a priority update.

To report a security vulnerability, please contact support@janekbehrens.de with the subject line "Security Report — CodeDoc". We aim to acknowledge reports within 2 business days.

11. Compliance

• GDPR: As personal data, the App stores Atlassian account IDs (who approved, discarded or undid a run, approved a sync block or dismissed the rating prompt) and the name of the Git account behind each Git connection, all in Forge storage for your site. Code that contains personal data is sent to the AI provider you connected with your own key, or processed by Atlassian AI. See our Privacy Policy for details.
• Atlassian Security: The App follows Atlassian Forge security requirements. Because it connects to Git and AI services outside Atlassian, it is not part of Atlassian's Runs on Atlassian program and offers no data residency options.
• Sub-processors: Atlassian only — it hosts the App on Forge (runtime and storage) under Atlassian's Forge Data Processing Addendum, which includes Standard Contractual Clauses for transfers outside the EEA. All other third-party data transmission is initiated by the user via their own credentials, or reads public registry data; Atlassian AI is part of Atlassian's platform.

12. What We Do NOT Have Access To

For complete transparency:

• Your API keys or Git access tokens
• Your source code or repository contents
• The generated documentation content
• Your Confluence instance data beyond what the App's scopes allow
• User identity, email addresses, or personal data (the account IDs the App stores stay in your site's Forge storage)