Security Policy

Page Tree Sorter for Confluence Cloud

As of: 2026-10-10

1. Reporting a vulnerability

Please report security issues via our support form. Please do not post them publicly. Include the steps to reproduce and the affected site and page, but no customer data.

• You get a first response within 2 business days (Monday to Friday, CET/CEST).
• We coordinate the disclosure with you.
• The app is not part of the Atlassian Marketplace Bug Bounty program.

2. Fix timelines and incidents

We fix vulnerabilities within the timelines of the Atlassian Marketplace Security Bug Fix Policy:

Security incidents that affect customer data are reported to Atlassian and to the affected customers without undue delay.

3. How the app is built

• The app runs entirely on Atlassian Forge. It uses no external servers and sends no data to third-party hosts.
• Data stays in Atlassian’s infrastructure: content properties on pages and Forge key-value storage.
• The app stores no page content, only IDs, titles (index), sort modes and the account ID of the person who set a mode. Details: privacy policy.
• Permissions are checked server-side for every action with the rights of the acting user (asUser). Only space admins can set modes; editors can sort once in standard mode.
• Only after this check the app moves pages with its own rights (asApp).
• Page and space IDs come from the trusted Forge context, not from the request payload.
• Dependencies are audited (npm audit) before every release.
• Logs contain no page content.

4. Other questions

For general questions use the support page.