Truewright is an early-access Jira admin tool built and run by a single independent developer. This page states plainly what that means for security, what the app actually does, and how to report a problem — written to match the code, not a template.
If you find a security issue in Truewright, email [email protected]. Please include steps to reproduce and, if possible, the Jira site or account type you tested on.
This is a solo-maintained project, not a staffed security team — expect an acknowledgement within 5 business days, not an automated instant response. There is no bug bounty program at this time.
Truewright is built on Forge, Atlassian's own hosted app platform. There is no separate backend server, database, or hosting account that could be breached independently of Atlassian's own infrastructure — every resolver call runs inside Forge's managed runtime.
The app requests only the scopes it uses: read:jira-user to list your site's directory, and storage:app to hold a customer-supplied organization API key. The one outbound permission, to api.atlassian.com, is used solely to call Atlassian's own Admin API with that key.
Truewright never asks for your Atlassian password or a personal access token. The only credential it stores is an organization API key that you generate yourself in admin.atlassian.com, specifically for this purpose. It's saved via Forge's encrypted secret storage (kvs.setSecret) and can be removed at any time from inside the app.
No end-user data — names, emails, activity, status — is written to storage. Every list view is fetched live on each page load and returned straight to the interface. Full detail is in the Privacy Policy.
Truewright is a pre-revenue, bootstrapped, solo-vendor product. It does not currently hold SOC 2, ISO 27001, HIPAA, or FedRAMP certification, and has not completed a CAIQ Lite questionnaire. This will be revisited as the business grows.
For anything not covered here, reach out at [email protected].