Gatetrail

Security

Report a vulnerability

Write to security@gatetrail.com. We confirm receipt, keep you informed, and credit you if you wish. Please give us reasonable time to fix an issue before disclosing it. Our security.txt has the same contact.

Security incidents

If we discover or learn of a security incident, actual or suspected, we notify Atlassian within 48 hours, as the Atlassian Marketplace Partner Agreement requires. Security incidents in this sense are unauthorized access to, or loss or disclosure of, End-User Data in our possession or control; a security vulnerability or compromise of the app; and an issue with the app that materially degrades Atlassian's systems. We inform affected customers without undue delay and publish advisories for the relay on this page and on npm.

How Gatetrail is built

  • Built on Atlassian Forge. The app runs only on Atlassian Forge, with no server of ours. It has no egress permissions: it talks only to Atlassian APIs. Your SonarQube™ token stays with you: it is used only by the relay in your CI to call your SonarQube™ and is never sent to the app or to us.
  • Authenticated deliveries. Webhook and relay deliveries carry an HMAC-SHA256 signature, checked in constant time; without the right secret, a delivery is rejected. Secrets are generated per SonarQube server and rotated on the admin page.
  • Validated input. Every delivery is checked against a schema with size and length limits; project keys, branches and URLs have strict formats.
  • Signed risk decisions. Decisions are signed with an Ed25519 key kept in Forge secret storage. The relay verifies the signature, which covers the ticket and its SonarQube target, and ignores decisions that do not verify.
  • Server-side permissions. Admin actions require Jira administrator permission; decisions require membership in the approver group; reports show only projects the viewer can browse.
  • Small supply chain. The relay is one bundled file with no runtime dependencies. Since version 0.2.0, our CI stages each release on npm through trusted publishing, so no npm token is stored in CI; a staged release goes live only after a maintainer approves it on npmjs.com with two-factor authentication.

Details on data are in the privacy policy and on data residency.