Security overview

SourceDocs is designed so that a security review has little to review: no servers of ours, no OAuth grant, one read-only credential, and a short list of hosts the app can reach.

Architecture

Platform. SourceDocs is an Atlassian Forge app. All backend code runs on Atlassian's infrastructure, in your site's region, under Atlassian's security controls. SourceDocs operates no servers.
Rendering. Markdown, Mermaid, PlantUML, OpenAPI and code highlighting run entirely in the reader's browser, inside the sandboxed Forge iframe. Diagram sources are never sent to a rendering service.
Outbound traffic. The backend may call only the Git provider APIs declared in the app manifest: api.github.com, raw.githubusercontent.com, gitlab.com, api.bitbucket.org, dev.azure.com. Forge enforces this list at the platform level; the app cannot reach any other host.
Images in Markdown. Images referenced from the repository are fetched by the backend with the stored credential and delivered inline. Images with absolute URLs are loaded by the reader's browser directly from that URL, but only from an allow-list of well-known hosts (GitHub, GitLab, Bitbucket, Azure DevOps, shields.io, Codecov and similar badge services). Images on other hosts are shown as a link.

Credentials

A Confluence administrator stores at most one read-only token per Git provider on the SourceDocs admin page (Confluence Settings → Apps → SourceDocs).
Tokens are written to Forge secret storage (encrypted at rest, scoped to your site and this app). They are never returned to any browser, never logged, and never included in cached content. The admin page only shows that a credential exists and when it was set.
Only the backend resolver reads the token, only to request a file from the provider over HTTPS.
Removing a credential on the admin page deletes it from Forge storage immediately. Revoke it at the provider as well.
We recommend fine-grained tokens limited to the repositories you embed, with read-only content permission.

Repository content

Files are fetched on demand when a page is viewed and cached in Forge Key-Value Storage inside your site for 10 minutes to limit provider API calls. Files above 200 KB are not cached. The Refresh button bypasses the cache.
Readers of a Confluence page see the file because the page's author embedded it. SourceDocs does not check the reader's own Git permissions; treat the embedding as you would pasting the content.
Uninstalling the app deletes all app storage (cache and credentials) per Forge's storage lifecycle.

Scopes and permissions

Permission	Why
`storage:app`	Cache fetched files and store credentials in the app's own storage. No access to Confluence content.
External fetch: Git provider hosts	Request files from GitHub, GitLab.com, Bitbucket Cloud and Azure DevOps.
External images: allow-listed hosts	Let the reader's browser display images that Markdown files reference by absolute URL on GitHub, GitLab, Bitbucket, Azure DevOps and common badge services (shields.io, badgen, Codecov, Coveralls, SonarCloud and others). No wildcard. Nothing is uploaded; this is a browser content-security allowance only.
Inline styles	Diagram engines emit inline SVG styles.

SourceDocs does not read, write or search Confluence pages, spaces or users. It does not request any Confluence content scope.

Telemetry

SourceDocs sends no analytics or telemetry. Atlassian's own platform metrics for Forge apps (invocation counts, errors) are visible to us in the Forge developer console in aggregate, without content.

Vulnerability reports

Write to security@sourcedocs.dev. We acknowledge within one business day and aim to ship a fix within seven days for confirmed issues.

Fix timelines

Confirmed vulnerabilities are fixed within the Atlassian Marketplace security bug fix policy timelines at the latest, and we aim for seven days for every severity. Dependencies are checked with npm audit before every release; no release ships with a known high or critical vulnerability.

Incident response

Detect and acknowledge. Reports to security@sourcedocs.dev, Atlassian notifications and Forge error alerts are reviewed every business day. A report is acknowledged within one business day.
Contain. If customer data or credentials may be exposed, we disable the affected feature or deploy a fix immediately; Forge lets us roll out to every installation within minutes.
Notify. Atlassian is informed through the Marketplace security channel and affected customers by email (their Marketplace technical contact) without undue delay and within 72 hours of confirmation, using Atlassian's incident and vulnerability notification templates. Admins are told which tokens to revoke at their Git provider.
Fix and verify. A patched version is deployed and verified on a test site; release notes describe the issue once a fix is available.
Review. Within two weeks we write a short post-incident review and update this page and our practices. This plan is reviewed and exercised once a year.