ScriptlineSecurity
Effective 03/11/2026. For security reviewers evaluating Scriptline for Jira.
Platform
Scriptline is built entirely on Atlassian Forge and runs on Atlassian's platform. Wattlebrooks Apps operates no servers for it, and no data is sent outside Atlassian.
- All code runs in Atlassian's hosted, sandboxed runtime.
- All stored data is kept in Atlassian-hosted app storage, encrypted at rest and following your site's data residency.
- The app declares no external network access, so it cannot contact any host outside Atlassian.
Permissions
| Scope | Why |
|---|---|
read:jira-user | Read the current user's profile, and check the user is a Jira administrator. |
read:jira-work | Let an administrator's script read work items. |
write:jira-work | Let an administrator's script comment on, update and transition work items. |
storage:app | Store scripts, their versions and run history on your site. |
No user-management, group, Jira-configuration, Confluence or admin scopes are requested.
Access control
- Admin-only. Scriptline is a Jira admin page, and every action independently checks the caller holds Administer Jira. Writing, saving, enabling and running scripts is limited to administrators.
- Who scripts run as. Saved hooks run as the app, limited to the scopes above. In the Console an administrator can choose "Run as: me" to run a script with their own Jira permissions.
- Only what you enable runs. Listeners, schedules, JQL functions and the scripted field run only after an administrator saves and enables them. A disabled hook never runs. The app ships no automations of its own.
- Everything is recorded. Every run is kept in Run history with its logs, result, status and timing.
Credentials and secrets
Scriptline never asks for or stores passwords, API tokens or other credentials. All access to Jira is through Atlassian-managed app authentication approved at install, so there is nothing to paste, rotate or leak.
Script safety
- Scripts receive only the Jira API, a logger and the trigger's context. They cannot import packages, read the app's storage or reach the network.
- Output is bounded: returned values are capped at 100 KB, a single run iterates at most 5,000 work items, and run history and versions are capped at 50 and 20.
- Treat scripts as code: review them like any other change. Versions and run history make every change and every run auditable.
Compliance
Scriptline inherits the security and compliance posture of Atlassian Forge (SOC 2, ISO 27001 and others; see Atlassian's Trust Center). Scriptline has no independent certifications.
Reporting a problem
If you think you have found a security issue, email support@wattlebrooks.com. We aim to reply within 2 business days, and fixes are noted in the release notes.