I really appreciate your participation in the thread! It helps a lot when a variety of people on the project team get involved with the community.
Fixing wording of vulnerability requirement
Understood. Can the wording be adjusted to reflect that? Maybe:
Apps must not use third‑party dependencies or packages with known Critical and High severity vulnerabilities, especially Critical and High severity vulnerabilities, and must prioritise patching when new vulnerabilities are disclosed.
All of this adds emphasis to my belief that a human absolutely needs to be in the loop for any heavy decisions made by the scanner (like withdrawing badges) based on excess permissions, before any such changes are made. I do not have complete confidence that an automated scanner will be able to pick up all of the nuances of permissions actually used, and especially not if it is being audited down to each individual fine-grained permission. And with the current trends to turn everything over to the AI chatbots, especially this part of the program needs to remain high-touch.
Can we change the wording of the “excess permissions” requirement?
As for the requirement itself, “Does not find any excessive permissions being requested that are not utilized in code”, there is a need for some wiggle room here too, as well as a longer time horizon.
What about the scenario I mentioned where vendors add a group of permissions in anticipation of certain features, but those features are not all built yet?
Can this be amended to “Does not find any excessive permissions being required that are not utilized in code…for a period of nine months”? (Or something similar)
Building apps by requesting permissions before they are used is a very necessary requirement for modern Forge development, to avoid the problem with excess fragmentation of app versions, as mentioned previously.
Permission scanning vs. Atlassian “release tracks”
Atlassian wants to coerce vendors into shipping almost all code behind feature flags, resulting in code that is left dormant for up to six months at a time (even once it has been fully built). How will this work in conjunction with the trust program’s permissions validation?
The apps will have to request permission for the endpoints yesterday, but you will not find any usages in the code via static analysis (because not all apps use your requestProduct() calls). You will not find it in the gateway metrics either (because it has been feature flagged off).
How will Atlassian design the validation to avoid a ton of false positives?