Security at Quicksloth

Last updated: 13 October 2026

Quicksloth builds apps for Atlassian Cloud on Atlassian Forge. Our Atlassian apps run only on Atlassian's infrastructure: they have no servers of their own and send no data outside Atlassian. Encryption in transit and at rest, hosting and backups of app data are provided by the Forge platform.

Our Shopify app, Quicksloth Size Chart, is in development. When it is live, this page will also describe how it is hosted and protected.

How we build

• Every action runs with the signed-in user's Confluence permissions (asUser). The app's own access (asApp) is used only to keep its search index in sync, never to show content to a user.
• Only the scopes the features need are requested.
• All input is validated on the server; database queries use bound parameters.
• Dependencies are checked with npm audit before every release.
• Logs contain IDs, status codes and counts, never credentials or tokens.
• Accounts used to build and publish the apps are protected by multi-factor authentication.

Reporting a vulnerability

Email security@quicksloth.dev with the app name, the steps to reproduce and the impact. We aim to acknowledge reports within 2 business days. Please give us reasonable time to fix the issue before sharing it publicly. We do not run a paid bug bounty program.

How we fix

We fix security vulnerabilities within the timeframes of Atlassian's Security Bug Fix Policy for Marketplace apps. For cloud apps: critical within 10 days, high within 4 weeks, medium within 12 weeks, low within 25 weeks.

If something goes wrong

If a security incident affects customer data, we notify Atlassian within 24 hours and affected customers within 72 hours, following Atlassian's app security incident management guidelines.

For our Shopify apps: if we learn of an actual or suspected breach of data from Shopify stores, we report it to Shopify Support through the Partner support page immediately, and no later than 24 hours after we become aware of it, as section 6.2.10 of the Shopify API License and Terms of Use requires. We then fix the cause, investigate, take reasonable steps against further harm and answer Shopify's questions, and we notify affected merchants as the law requires.

Incident response plan

1. Detect. Sources: reports to security@quicksloth.dev, Atlassian Marketplace Security (AMS) tickets, Forge logs and Developer Console errors.
2. Assess. Decide whether customer data is affected and how many customers. Rate vulnerabilities with CVSS.
3. Notify. Security incident: open a P1 ticket with Atlassian no later than 24 hours after we learn of it, and notify affected customers within 72 hours, using Atlassian's communication template. Critical vulnerability: raise an AMS ticket and notify customers with Atlassian's vulnerability notification template. Shopify apps: report to Shopify Support within 24 hours, as described above.
4. Contain. Fix, or disable the affected feature, and deploy. During containment, update Atlassian at least every 6 hours.
5. Recover and review. Confirm the fix in production, write a short post-incident review, add it to the Atlassian ticket, and add a test or check so the same issue cannot come back.

Security notices

When we cannot reach an affected customer directly, for example on a free plan, we publish the notice here. There are no security notices.

Contact

Security: security@quicksloth.dev · Support: support@quicksloth.dev · Data Processing Addendum: Quicksloth Q&A for Confluence