PPFTECSecurity Policy — Markdown Mode for Jira
Last reviewed: 28 October 2026. Provider: PPFTEC S.R.L.
This policy describes the architecture and security practices of Markdown Mode for Jira, our app for Jira Cloud. It covers the app that edits issue descriptions and comments through the issue Actions menu. Read our Privacy policy for privacy and support-correspondence information.
Application architecture and data handling
The app uses Atlassian Forge Custom UI. Atlassian hosts its static application resources, and the editor runs in the user's browser inside Jira. The app declares no Forge functions, app-owned database or Forge storage, remote backend, or external network destinations. PPFTEC operates no application server that receives Jira content from this app. The PPFTEC documentation website is a separate service hosted on Cloudflare.
During use, the app reads and processes issue descriptions, comments, issue identifiers and relevant comment-author metadata in the browser. It converts content between Markdown and Jira's native Atlassian Document Format (ADF), displays a preview, and sends descriptions or comments back to Jira when the user chooses to save. Saved content remains in the customer's Jira site under Atlassian's controls and the customer's configuration. Removing the app does not delete that Jira content.
The app keeps two display preferences, layout and line-break mode, in browser localStorage under the mmj: prefix. It does not use that storage to retain issue content, draft comments or credentials. Unsaved editing content is held in the active page's memory; closing the page is not a secure-erasure guarantee. Copy as Markdown places content on the user's clipboard. Files, clipboard copies and content pasted into another tool are governed by the customer's device and sharing practices, rather than a separate encryption or deletion service provided by this app.
Access and permissions
Jira API calls use Atlassian's requestJira bridge as the interacting user. The declared scopes are read:jira-work for reading issue content and permissions, and write:jira-work for the requested description and comment updates. Jira permissions and app scopes constrain access; Jira enforces authorization on API writes. A licence check or a permission indicator in the editor is not a replacement for that enforcement.
The app does not ask users to supply Jira passwords, personal API tokens or service-account credentials. It does not provide a PPFTEC backend service account with independent access to a customer's Jira site.
Platform protection and application safeguards
Transport and stored Jira content use Atlassian's platform controls. PPFTEC has no separate customer-content database or encryption-key service for this app. Atlassian's Forge security requirements identify platform-provided controls; the shared responsibility model leaves application logic, permissions, input handling and maintenance with the app developer.
The preview uses React components rather than executing pasted Markdown as HTML or code. Users can inspect the proposed result before saving. Jira elements that Markdown cannot represent are retained as protected content. The description workflow checks for a changed description before saving; this is a usability safeguard, not a guarantee of an atomic lock against every concurrent edit. Treat pasted content as untrusted and review it before saving or copying elsewhere.
Vulnerability reporting and maintenance
Report suspected app vulnerabilities privately to support@ppftec.com. Include the app name, affected version, impact and minimal steps to reproduce, preferably with fictional data. Do not send passwords, tokens or confidential ticket contents. Do not access other users' data or disrupt a customer site while investigating a report.
Our maintenance process is to assess reported issues and dependency advisories for applicability and severity, prepare a fix, check relevant regression tests and obtain release authorization before deployment. Repository checks include type checks, automated tests, a build, manifest validation and production-dependency auditing. A check or audit does not establish the absence of vulnerabilities. We follow the applicable Atlassian Marketplace Security Bug Fix Policy and case-specific Atlassian requirements for remediation. We keep reporters informed of material progress. This page does not promise a separate fixed acknowledgement or resolution deadline.
Incident response and communication
Suspected compromise of an app-maintenance account, an unintended release, or possible unauthorized disclosure or modification of customer content is investigated under PPFTEC's written incident-response process. We assess scope and impact, preserve relevant evidence, choose containment and remediation measures, verify the corrective action and record lessons learned.
We coordinate with Atlassian through its security support process under the app security incident guidelines. Where customers may be affected, we communicate the known impact and protective actions through available support or technical-contact channels. Communications distinguish confirmed facts from unresolved questions and avoid unnecessary exposure of customer data.
Logging, assurance and policy updates
The app has no end-user content logging or third-party telemetry integration and declares no backend function that would create app backend logs. It is not a continuous customer-content monitoring service. Atlassian and the documentation website's hosting provider may process technical operational data for their services. Support or security correspondence is separate from app runtime data.
This policy makes no claim of independent penetration testing, ISO certification or a dedicated 24/7 security operations centre. It is not a guarantee that incidents cannot occur. We review the policy when the app architecture or security process changes and update its review date. For usage help, see Support and documentation.