# Feedback Request: Security Requirements for Cloud Apps **URL:** \ **Category:** Announcements\ **Tags:** ecosystem, trello, ecosystem-security, security, atlassian-connect, forge\ **Created:** [June 2, 2022, 12:18am UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782 "2022-06-02T00:18:20Z")\ **Posts on this page:** 5\ **Page:** 2
**Author:** ![dzagorovsky](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dzagorovsky/32/35913_2.png) [@dzagorovsky](https://community.developer.atlassian.com/u/dzagorovsky)\ **Post date:** [June 21, 2022, 4:54pm UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782/21 "2022-06-21T16:54:59Z")
I have a question about Content Security Policy (CSP) header from requirement 7.1 Do you have any acceptance criteria for CSP (set of required Fetch directives except script-src)? Maybe you could provide a recommended way to assess the strength of a CSP (for example all green marks in [https://csp-evaluator.withgoogle.com](https://csp-evaluator.withgoogle.com))? ---
**Author:** ![dzagorovsky](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dzagorovsky/32/35913_2.png) [@dzagorovsky](https://community.developer.atlassian.com/u/dzagorovsky)\ **Post date:** [June 21, 2022, 5:20pm UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782/22 "2022-06-21T17:20:38Z")
Question about third-party libraries and dependencies with known critical or high vulnerabilities from requirement 9. In some cases, third-party libraries and dependencies with known critical or high vulnerabilities do not affect an app. Sometimes it is not possible to update such dependencies asap because the fix is not available yet. Could you please recommend what should we do in such cases? ---
**Author:** ![SrivathsavGandrathi](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/srivathsavgandrathi/32/43905_2.png) [@SrivathsavGandrathi](https://community.developer.atlassian.com/u/SrivathsavGandrathi)\ **Post date:** [June 23, 2022, 1:05am UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782/23 "2022-06-23T01:05:00Z")
> I have a question about Content Security Policy (CSP) header from requirement 7.1 @dzagorovsky we wanted to let our developer community start implementing Content Security Policy (CSP) to mitigate most script injection-related vulnerabilities. The recommendation would be to start by specifying the script sources and not using `unsafe-inline` or `unsafe-eval` directives. This should give the minimum protection CSP offers. [https://csp-evaluator.withgoogle.com/](https://csp-evaluator.withgoogle.com/) can be used to validate your policies. > Question about third-party libraries and dependencies with known critical or high vulnerabilities from requirement 9. We recommend avoiding the usage of libraries or dependencies with critical or high severity vulnerabilities and instead use a patched version of these dependencies. If available, use an alternative library/dependency that is free from high/critical severity vulnerabilities. In case, neither is possible, we suggest you evaluate the risk and exploitability of the vulnerability and apply any known workarounds. However, when there is a zero-day vulnerability identified (e.g. [Spring4Shell](https://nvd.nist.gov/vuln/detail/CVE-2022-22965)) on a library that significantly impacts customer data, we will file an AMS ticket, and developers are expected to resolve them within the due date specified on the ticket. ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [June 24, 2022, 11:04am UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782/24 "2022-06-24T11:04:29Z")
> [@Action required: Updates to security requirements for cloud apps](https://community.developer.atlassian.com/t/action-required-updates-to-security-requirements-for-cloud-apps/59325): > > A few weeks ago, we shared a [draft](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782) of new security requirements for Marketplace apps. Thank you all for weighing in. We’ve incorporated your feedback into the final version, which we’ve now published here: [Security requirements for cloud applications](https://developer.atlassian.com/platform/marketplace/security-requirements/) One major concern we heard was around timelines - partners requested more time to fulfill the requirements than we had originally proposed. We’ve extended the date to bring apps into compliance, and partners now have until October 31, 2022 to meet… Now that draft requirements have become published, I’m locking this thread. All feedback and questions are still welcome, please just post them as new topics. ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [June 24, 2022, 11:04am UTC](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782/25 "2022-06-24T11:04:39Z")
[Previous page](https://community.developer.atlassian.com/t/feedback-request-security-requirements-for-cloud-apps/58782.md?page=1)