Trust center
Security and Incident Response
Last updated:
Security contact
Report suspected vulnerabilities or security concerns to [email protected]. Please do not include customer data, credentials or secrets in a report. Describe the issue, the affected version or site, and steps to reproduce.
Vulnerability disclosure policy
- Send reports to the contact above. We acknowledge a report within 3 business days and keep the reporter informed.
- We ask for coordinated disclosure: please give us a reasonable time to fix a confirmed issue before public disclosure; we will agree a date with you.
- Out of scope: Atlassian’s platform itself (report to Atlassian), social engineering, and denial-of-service testing.
- Hooq does not currently run its own paid bug bounty.
Fix targets
Severity uses the CVSS v3.1 base score, adjusted for Hooq’s context. Times run from confirmation of the issue.
| Severity | First response | Fix or mitigation target |
|---|---|---|
| Critical (9.0 to 10.0) | Within 3 business days of the report (sooner for active exploitation) | 7 days |
| High (7.0 to 8.9) | Within 3 business days | 30 days |
| Medium (4.0 to 6.9) | Within 3 business days | 90 days |
| Low (0.1 to 3.9) | Within 3 business days | Best effort, normally the next scheduled release |
Incident response
Hooq follows a documented process: detect, triage and classify, communicate, resolve, and post-incident review. The full process and severity definitions are in the Incident Response Plan. Customers affected by a security incident involving their data are notified directly, without undue delay and no later than 72 hours after Hooq confirms a breach affecting their data. A written post-incident summary is shared with affected customers within 10 business days. Hooq reports security incidents to Atlassian promptly, as required by the Atlassian developer terms.
Logging
We use logs to fix issues, and to fix issues earlier than they are reported. The developer reads the app’s logs through the Atlassian Forge logging tools (site administrators can turn that access off) only to troubleshoot, to fix reported issues and to find and fix issues before they are reported. Details, including what a log line may contain and the in-app error log (3 days, 400 entries), are in Data Logging and Retention.
Security responsibilities
Hooq runs on Atlassian Forge. Under Atlassian’s Forge shared responsibility model, Atlassian operates the runtime, network security, storage encryption at rest, tenant isolation, authentication of users before the app is invoked, DoS protection, platform monitoring and platform vulnerability management. Hooq is responsible for its application logic, authentication of its web triggers (signed requests with timestamp and replay protection), input validation, dependency management, secure use of storage and app-level retention. Vulnerability management, security incident response and disaster recovery are shared.
Hooq requests only the Jira permissions (scopes) listed in its Marketplace listing and at installation, and makes no call to a non-Atlassian host.