Bitwerf

Security policy

Version 1.0, 1 November 2026. Applies to every app published by Bitwerf (BizzKitt B.V.) on the Atlassian Marketplace.

Security contact: hello@bizzkitt.ai. We answer security reports within 2 business days.

1. How our apps are built

• All Bitwerf apps run on Atlassian Forge. We operate no servers, databases or third-party services of our own. App data lives exclusively in Forge storage on Atlassian's infrastructure, in the region of the customer's site, encrypted at rest and in transit by Atlassian.
• No app egresses data to any host outside Atlassian. Our manifests declare no external permissions.
• Each app requests only the API scopes it needs (least privilege). Actions on behalf of a user run as that user, so the product enforces the user's permissions; administrator functions check the administrator permission before they run.
• Apps never collect Atlassian passwords, API tokens or third-party credentials. The one secret an app can hold (the CI token of BDD Scenarios for Jira) is created by a Jira administrator, stored only in Forge storage and compared in constant time.
• User input is validated and escaped before it is stored or rendered; rendered diagrams and formulas are sanitised in the browser (no scripts, no external loads).
• Forge logs contain error messages only, never personal data, content or secrets. Access to logs is limited to the app's contributors.

2. Development and release practices

• Automated tests (unit, backend and browser tests) run before every release.
• Production dependencies are scanned with npm audit before every release and are pinned in a lock file; known vulnerabilities are fixed before the release ships. The dependency list (software bill of materials) is kept per released version.
• Releases are built from a clean, reproducible build and deployed through the Forge CLI with a dedicated, rotated API token that is never committed to code.
• Development accounts use multi-factor authentication where the provider supports it; development credentials are kept outside the code base and rotated.

3. Vulnerability management

We follow the Atlassian Marketplace security bug fix policy. Reported or discovered vulnerabilities are triaged within 2 weeks and fixed within the policy's deadlines:

Fixes are released as new app versions; Forge apps update automatically on every customer site. Affected customers and Atlassian are notified of critical vulnerabilities using Atlassian's vulnerability notification template.

4. Responsible disclosure

If you believe you have found a security issue in a Bitwerf app, email hello@bizzkitt.ai with the app name, a description and steps to reproduce. Please do not access data that is not yours and do not disrupt customer sites. We confirm receipt within 2 business days, keep you informed, and credit you if you wish. We do not pursue legal action against good-faith research that follows these rules.

5. Incident response plan

A security incident is any event in which customer data in one of our apps may have been exposed, altered or made unavailable through a weakness in the app or in our accounts.

1. Detect and record (immediately): the report or alert is logged with time, app, scope and reporter. Sources: security reports to hello@bizzkitt.ai, Atlassian's AMS/ECOHELP tickets, Forge alerts and logs, customer reports.
2. Contain (within hours): disable the affected function, roll back to the last safe version, rotate any exposed credential, or, where needed, delist the app version. Atlassian is consulted on containment options.
3. Notify Atlassian (within 24 hours): raise a P1 ticket through the Atlassian ecosystem service desk with category, scope, data types involved, containment measures, expected resolution time and our contact details; update Atlassian at least every 6 hours until contained, following the Atlassian incident management guidelines.
4. Notify customers (within 72 hours where customer data is affected): using Atlassian's incident communication template, with what happened, what data was involved, what we did and what the customer should do. Notifications to data protection authorities follow the GDPR where they apply.
5. Resolve: ship the fix as a new version, verify on a test site, confirm no indicators of compromise remain.
6. Review (within 2 weeks): write down cause, timeline, impact and lessons learned; add tests or controls that prevent recurrence; submit the review through the original ticket.

Roles: BizzKitt B.V. management (hello@bizzkitt.ai) owns the incident, decides on containment and customer communication, and is the contact for Atlassian and customers.

6. Data retention and deletion

Each app's privacy section describes what it stores and for how long; see the privacy policy. Atlassian deletes an app's Forge storage when the app is uninstalled. Apps that store account IDs report them weekly to Atlassian's personal data reporting and remove the data of closed accounts.

Bitwerf is a trade name of BizzKitt B.V., Frederikstraat 67, 3034 LD Rotterdam, the Netherlands (KvK 42149345, VAT NL869932354B01). Support · Privacy · Terms · Security