Trust Center

Authentication model

The Atlassian Automation Rule Management API does not yet support direct authentication from Forge/OAuth2 apps. This version uses Basic Auth with an administrator email and API token, provided voluntarily by the customer's administrator.

How the credential is handled

• Stored exclusively via Forge's secret storage (kvs.setSecret).
• Never returned to the frontend once configured.
• Used only in the app's backend, to build the Authorization header for calls to the Atlassian Automation API.
• Tested with a verification call before being persisted, to fail fast on an invalid credential.

Network egress

The app communicates only with Atlassian's own domains:

• https://api.atlassian.com — Automation Rule Management API (publicly documented).
• The installed site's own validated *.atlassian.net domain — used for an internal endpoint (highUsageFlows/highestUsages) that powers the Overview screen with observed consumption data.

Forge manifest permissions cannot be scoped to a single customer's hostname ahead of time (every customer has a different Atlassian domain), so the manifest declares the wildcard pattern *.atlassian.net, while runtime code restricts every request to the current installation's own site: the base URL is fetched from Jira's own serverInfo endpoint (never free user input), the protocol must be HTTPS, the hostname must exactly match the atlassian.net domain (rejecting look-alikes such as atlassian.net.malicious-domain.com), non-standard ports are rejected, and embedded credentials in the URL are rejected.

Experimental data source (Overview screen)

The highUsageFlows/highestUsages endpoints are internal endpoints used by Atlassian's own Automation UI, not a publicly documented or supported API. Because of that:

• Every response using this source is explicitly marked experimental.
• The app treats this source with capability-based degradation, checked via a health check when the credential is saved and on every Overview load: Full Usage (Automation Steps and execution ranking both available), Execution-only (Steps unavailable, ranking still works), or Unavailable (falls back to the structural analyzer, with no impact on the rest of the app).
• A failure in this source never invalidates an otherwise-valid connection to the Rule Management API.

Error handling

The interface only receives stable, public error identifiers and messages (e.g. authentication failure, rate limiting, provider unavailable). Raw HTTP response bodies and internal details are never included in resolver responses; this sanitization has dedicated automated test coverage. Backend logs may contain bounded diagnostic messages but never log the API token or Authorization header.

Cached data

The app keeps a short cache (up to a few minutes) of the current month's observed consumption, to reduce repeated calls to the usage endpoint. This cache holds only automation metadata (name, state, executions, steps, timestamps) — never the access credential. The interface shows when the data was last refreshed and offers a manual refresh action.

Large-site pagination resilience

On sites with a large number of rules, loading the full Usage dataset in a single call could exceed Forge's execution time limit for a function invocation. To handle this, the app loads Usage in small page chunks across multiple continuation calls, with visible progress in the UI. If a specific page fails persistently, it is skipped after repeated attempts so the rest of the dataset still loads, rather than blocking indefinitely; the count of skipped pages is shown in the interface. The app also backs off with increasing delay if the endpoint responds with a rate limit.

Cost estimate calculation

The app calculates an estimated exposure to Atlassian's extra-usage billing (effective December 3, 2026), using the public formula excess steps ÷ 1,000 × US$0.50. This estimate is calculated locally from observed/projected consumption and the allowance entered by the administrator; it does not reflect a real invoice, and is always shown with that disclaimer. It is presented as a range (not a single number), with a declared heuristic margin, since we do not have access to the daily time series that Atlassian's own native forecast uses.

Testing

The app's calculation logic (allowance impact, portfolio aggregation, usage normalization, pagination resilience, error sanitization, and host validation) is covered by an automated test suite, including tests that specifically assert sensitive details never leak into public error messages, and that hostnames mimicking Atlassian's domain are rejected.

Reporting a vulnerability

If you identify a security vulnerability in this App, contact support@app-rl.com directly, without prior public disclosure.

Updates to this Trust Center

This page is reviewed whenever the authentication architecture or data sources change, and at minimum before any Atlassian Marketplace submission.