Public security policy for QuantMatrix apps distributed through the Atlassian Marketplace.
QuantMatrix Forge apps are designed to use Atlassian-hosted Forge runtime capabilities and least-privilege permissions. Unless an individual app listing explicitly says otherwise, the app does not use external remotes or external data egress.
Rework & Reopen Intelligence for Jira is read-only, uses only read:jira-work, has no external remote, no external egress, and does not persist customer data in app storage in its initial release.
The app accesses Jira data only through Atlassian APIs and the permissions of the current user remain authoritative. The app does not request write scopes and does not modify Jira work items.
Report suspected security issues privately to security@quantmatrixintelligence.com. Please include the affected app, reproduction steps, and relevant technical details. Do not include unnecessary customer data.
Security reports are triaged according to severity. Where a confirmed issue materially affects customers, QuantMatrix will coordinate remediation and appropriate customer communication.