Hey, everyone! :grinning: In the near future, Ecosystem Security is planning to publish an update to the security requirements for cloud apps , which fits into our overall goal of elevating trust in the marketplace. Some of you may have heard about this initiative already; we’ve recently shared a pr…

Just a bit nitpick here - but why is #10 (" An application must not collect or store credentials belonging to Atlassian user accounts such as user passwords or user API tokens.") under Privacy? Especially since the linked document doesn’t talk about user credentials.

For the Forge scopes - I’m a bit confused. The granular scopes is on hold according to Action required: Update scopes for Forge and OAuth 2.0 (3LO) apps - should those sections be removed?

An application must not use versions of third-party libraries and dependencies with known critical or high vulnerabilities. When vulnerabilities in these libraries and dependencies are discovered, an application owner must remediate them as quickly as possible. This once more time br…

Hi @clouless , thank you! It depends on what the “custom permissions” are trying to achieve really. We do not recommend attempting to build an “offline copy” of the product permission model in your app, as it would quickly become out of date from the permissions enforced in the products. However, If …

Hi @marc , both Connect & Forge apps are prohibited from requesting Atlassian API tokens from users and are not allowed to store them or use them in any way per the updated security requirements for Marketplace cloud apps. Apps should only authenticate with Atlassian products by using approved authen…

Hi @danielwester , This would let us explain to customer why other application types (such as standalone apps using oAuth). Sure, we will link supporting documentation on the DAC page. Just a bit nitpick here - but why is #10 (" An application must not collect or store credentials belonging to …

[image] SrivathsavGandrathi: For the Forge scopes - I’m a bit confused. The granular scopes is on hold according to Action required: Update scopes for Forge and OAuth 2.0 (3LO) apps - should those sections be removed? I understand and apologize for the confusion on this topic in general. Our …

[image] SrivathsavGandrathi: Hi @kazimir_io , This once more time brings up the question what should we do about Atlaskit libraries that are essential to the apps and are too complex to DIY for vendors, but Atlassian refuses to officially support, eg editor and jql-editor libraries. They have …

[image] SrivathsavGandrathi: It was added under Privacy due to its impact on unintended access to cross-product (Jira/Confluence/JSM) data. Atlassian API keys are not scoped and allow similar access to product REST APIs that user credentials provide. The link was provided as a reference to gener…

Feedback Request: Security Requirements for Cloud Apps

Announcements

ibuchanan June 24, 2022, 11:04am 24

Now that draft requirements have become published, I’m locking this thread. All feedback and questions are still welcome, please just post them as new topics.