Security

Architecture

LimitRadar is built entirely on Atlassian Forge and declares no remotes and no external permissions, which is what Atlassian's Runs on Atlassian programme requires. The badge itself is awarded by Atlassian. The app has no servers of its own.

• User interface: Forge Custom UI with the Atlassian Design System and design tokens, in light and dark themes. It talks only to the app's own Forge functions and loads no external scripts, fonts or frames.
• Logic: Forge functions, scheduled triggers, product event triggers and queue consumers inside Atlassian.
• Storage: Forge SQL and the Forge key-value store (hosted storage), on Atlassian infrastructure.
• No remotes: no Forge Remote, no Connect, no web triggers, no backend operated by Radrly, and no public REST API.

Data flow

Inside the Atlassian cloud, LimitRadar reads data from Jira Cloud through Forge platform APIs, computes its results in Forge functions, stores them in Forge hosted storage and shows them to authorised users inside the Atlassian product. Nothing leaves Atlassian: there is no connection to external servers, third-party APIs or external AI services.

LimitRadar writes to Jira only when an administrator runs a cleanup action or confirms a Rovo action, and when it creates the alert, digest, report or approval work items you configured.

Exports are generated for download by the signed-in user. Radrly receives no customer data.

Scopes

LimitRadar declares all of its scopes in its Forge manifest. They are shown when you install the app and on the Marketplace listing.

• Read (measurement): granular read:* scopes for fields, field schemes and field configurations, custom field contexts and options, work types and work type schemes, workflows and workflow schemes, statuses, permission schemes and permissions, space roles, groups and users, work item security schemes and levels, spaces, versions, components, priority schemes, screens and screen schemes, filters, dashboards and boards, and work item counts.
• Audit log: read:audit-log:jira to backfill who created a field and when.
• Write and delete (cleanup actions): the granular scopes needed to trash and restore fields, edit field schemes, archive and merge releases, delete and merge components, remove and re-add grants and role actors, edit work type and priority schemes, disable and delete options, delete inactive workflows, unused statuses and orphaned schemes, and edit workflow scheme mappings.
• Work items: write:issue:jira to create alert, digest, report and approval work items in the space you choose, and to copy values during a field merge you run.
• Privacy: report:personal-data for Atlassian's personal data reporting.
• Storage: Forge SQL and the Forge key-value store.

LimitRadar declares no external hosts (permissions.external), no remotes and no web triggers.

No egress

LimitRadar declares no external hosts and makes no outbound network calls. It uses no Forge Remote, no Connect, no web triggers and no fetch to external services. There are no Slack, Teams or email webhooks. The app sends no telemetry to Radrly or any third party.

Requests to Atlassian products use Forge's authenticated platform APIs. The app does not handle passwords, personal access tokens or shared secrets.

Data protection

• At rest: data is stored in Atlassian's Forge hosted storage, which Atlassian encrypts at rest.
• In transit: traffic between the browser, the Atlassian products and Forge uses TLS, managed by Atlassian.
• Data residency: app data follows the data residency location of your site. Radrly does not store data anywhere else.
• Minimisation: Display names and email addresses (resolved when a page is shown), IP addresses, work item content. Field values copied during a merge are written to Jira and not stored by LimitRadar.
• Logs: the app logs operational status, job identifiers, counters and timings in the Forge developer console, without personal data or customer object names.

Access control

• Server-side checks first: every resolver and Rovo action checks the signed-in user's permissions and app role on the server before it reads any data as the app. Roles, space lists and flags sent by the browser are never trusted.
• Validated input: every payload is validated against a schema; Forge SQL queries use prepared statements only.
• No Radrly backend: the app has no code path that sends your data to Radrly, and Radrly operates no server that holds it.

Data lifecycle

• Install: the app asks for the scopes above and creates its storage.
• Use: Snapshots, logs and reports are kept for the default retention period while the app is installed; in the Advanced edition an administrator can configure retention. Undo data is kept for as long as undo is possible.
• Uninstall: the Forge platform deletes the app's data according to Atlassian's policy for Forge hosted storage. Radrly keeps no copy.

See the Privacy Policy for details.

AI statement

LimitRadar does not use Forge LLMs. The optional Rovo agent runs in Atlassian Rovo and reads LimitRadar data through Forge actions inside Atlassian.

Compliance

LimitRadar runs on Atlassian Forge. Atlassian's platform certifications cover Forge hosting; Radrly does not claim them as its own. For Atlassian's reports, see the Atlassian Trust Center. Radrly will complete the Marketplace security requirements that apply to the app.

Incident response

If Radrly becomes aware of a security incident affecting customer data in LimitRadar, we will notify affected customers without undue delay, and in any event within 48 hours, with the information available to us, and keep them updated.

Secure development

• Automated checks before every production deployment: formatting, linting, type checking, unit tests and Forge lint.
• Dependency updates and vulnerability checks on production dependencies, and static code analysis.
• Secrets only in the build system; no secrets in the code.
• forge eligibility before every release, to keep Runs on Atlassian.

Reporting a vulnerability

Please email marcin@radrly.com with the subject [LimitRadar security], a description, steps to reproduce and the impact you see. Do not include customer data. We will acknowledge your report within 2 business days and keep you informed until it is resolved. Please give us reasonable time to fix the issue before disclosing it.