Security policy

This policy covers the Brain Static Threads apps on the Atlassian Marketplace (Specpane, Answerpane and Chatpane), the services that support them, and this website. It was adopted on October 5, 2026, last updated on November 10, 2026, and is reviewed every year and after any security incident.

Reporting a security issue

Email support@brainstaticthreads.com with "Security" in the subject line. Please include the app, what you found, and the steps to reproduce it. We confirm receipt within 2 business days, keep you updated while we work on it, and tell you when it's fixed.

You can also report through Atlassian's Marketplace security (AMS) process.

How we handle vulnerabilities

• Triage: every report is checked, reproduced and scored with CVSS v3.
• Fix: fixes meet Atlassian's Marketplace deadlines for Cloud apps, counted from when the issue is reported: critical (CVSS 9.0 or higher) within 10 days, high (7.0 or higher) within 4 weeks, medium (4.0 or higher) within 12 weeks, low within 25 weeks. Critical issues are worked on immediately.
• Patch: fixes are tested, then deployed to all customers through Atlassian's platform. Customers don't need to install anything.
• Dependencies: the apps use few third-party packages. They're checked for known vulnerabilities before every release, and known vulnerabilities are fixed before deploying.

How we handle security incidents

1. Detect: an alert, a report, or unusual activity in logs or accounts.
2. Contain: revoke or rotate affected secrets and tokens, disable the affected feature or app version, and end affected sessions.
3. Assess: what happened, which customers and data are affected, and whether it's ongoing.
4. Notify: Atlassian within 24 hours, and affected customers without undue delay, within 72 hours where feasible, as our Data Processing Addendums describe.
5. Fix and recover: ship the fix, confirm it works, and restore normal service.
6. Learn: record the cause and what changes so it doesn't happen again.

Security controls

Access control and authentication

• Every account used to build and run the apps, including Atlassian, Google, Cloudflare and GitHub, uses multi-factor authentication and a unique password.
• Only the owner has access to these accounts. Access, connected apps and API tokens are reviewed every quarter, and anything unused is removed.
• Inside your Atlassian site, the apps check the signed-in person's own Jira or Confluence permissions before showing or changing anything, and request only the scopes they need.

Data protection

• App data is stored in Atlassian Forge storage, which Atlassian encrypts at rest. Chatpane's message routing service stores only link codes and account links in Cloudflare D1, which Cloudflare encrypts at rest.
• All data moves over HTTPS (TLS) between Atlassian, Google, Cloudflare and the apps.
• We run no servers of our own, and we don't copy your page or work item content outside these platforms except to deliver what you set up (for example, a Chatpane message to your Google Chat space).
• App secrets are stored only as encrypted Forge variables or Cloudflare secrets, never in source code or email. They're rotated every year, and immediately if exposure is suspected.

Monitoring, logging and infrastructure

• The apps run on Atlassian Forge and Cloudflare Workers, so servers, networks and patching are handled by those platforms' security programs.
• Logs record errors and operational events. They never contain credentials, tokens, webhook URLs, page or work item content, or personal data beyond what Atlassian's platform adds. Only the owner can read them.
• Development happens on an encrypted computer with antivirus and automatic updates on.
• Code follows the OWASP Top 10 and Atlassian's Forge security guidance. Automated tests, including permission checks, input validation and output escaping, run before every deploy and block it if they fail. Changes are checked in a development environment before release.

Vendors

We use only established providers with published security programs: Atlassian, Google, Cloudflare and GitHub. A new provider is reviewed for its security and privacy commitments before any customer data goes to it.

Contact

Security questions: support@brainstaticthreads.com.