Last updated: October 22, 2026
Conf2Git version: September 2, 2026. SQR coverage was published on October 22, 2026 and applies from the product’s first public availability through Atlassian Marketplace. Publication of this policy does not announce SQR’s Marketplace availability. Each customer’s agreement takes effect under its applicable agreement.
This policy applies to Conf2Git – Markdown Sync for Confluence and Service Quality Review for Jira Service Management, provided by Magnascale Inc. Product-specific architecture and controls are described separately below.
Report a vulnerability
Security issues involving either covered product may be reported to:
Please include enough information to understand and reproduce the issue, such as the affected app version, relevant site or run identifiers, approximate time and time zone, reproduction steps, expected impact, and a safe proof of concept where appropriate.
Do not send credentials, private keys, OAuth secrets, JWTs, access or installation tokens, authorization headers, Marketplace licence payloads, raw provider responses, Confluence page bodies, generated Markdown bodies, or attachment/image contents.
Magnascale aims to acknowledge security reports within two business days and perform initial triage within five business days.
These are operational objectives and are not a contractual service-level agreement.
Remediation timing and required notifications depend on severity, exploitability, customer impact, applicable law, and the nature of the issue.
Conf2Git security architecture
Conf2Git is designed around a limited, one-way data flow:
Confluence Cloud → Atlassian Forge → customer-selected GitHub repository
Key security properties include:
- Confluence access is read-only. Conf2Git has no Confluence write-back path.
- GitHub access uses GitHub App installation authentication. Personal access tokens are not supported.
- Repository publication is limited to the customer-configured non-default branch.
- Conf2Git does not force-push.
- Ownership and provenance controls restrict changes and deletions to files managed by Conf2Git.
- Administrative, entitlement, tenant, mapping, run, lease, repository, and publication checks are enforced server-side at the applicable security boundaries.
- Customer content and credentials are excluded from intentional application logging.
- Production backend GitHub egress is limited to the GitHub services required to authorize and operate the customer-selected repository.
- Conf2Git does not operate a separate Magnascale-hosted backend or content store for customer Confluence content.
Conf2Git secrets and customer content
Conf2Git is designed not to persist or intentionally log:
- GitHub App private keys or OAuth secrets;
- JWTs, user tokens, installation tokens, or authorization headers;
- raw Marketplace licence contexts or provider responses;
- Confluence page bodies;
- generated Markdown bodies; or
- attachment or image bytes.
Selected Confluence content is processed to generate the customer-requested GitHub output. Generated Markdown and eligible images are written to the customer-selected GitHub repository.
Bounded configuration, identifiers, status, audit, checkpoint, diagnostic, and recovery metadata may be stored using Atlassian Forge hosted services as required to operate the application.
Access controls
Sensitive application operations require current server-side authorization.
Magnascale operational access is limited to authorized personnel with a business need for support, security, reliability, troubleshooting, abuse investigation, or incident response.
Operational access is intended to follow need-to-know, least-privilege, and confidentiality requirements.
Conf2Git third-party platforms
Conf2Git depends on:
- Atlassian Cloud and Atlassian Forge; and
- GitHub, as the customer-selected publication destination.
Customers remain responsible for their Atlassian and GitHub accounts, repository permissions, organizational policies, branch controls, and authorized administrators.
Security claims
Unless separately and explicitly stated with supporting evidence, Magnascale does not claim that Conf2Git has:
- SOC 2 certification;
- ISO 27001 certification;
- Cloud Fortified status;
- an independent penetration-test certification;
- a public bug-bounty program; or
- a contractual vulnerability-remediation SLA.
Coordinated disclosure
Please avoid public disclosure of an unresolved vulnerability until Magnascale and the reporter have had a reasonable opportunity to coordinate remediation and customer protection.
This policy does not create a bug-bounty payment obligation or legal safe harbor.
For privacy information, see the Magnascale Privacy Policy.
For support, visit Magnascale Support.
SQR security
Application controls
The app runs on Atlassian Forge, stores runtime app data in hosted storage and uses Atlassian APIs plus Forge LLMs. Its manifest declares no remote backend, web triggers or external egress. Customer support/contact-form records are separate vendor workflows.
Server-side checks use trusted installation and actor context, current program roles, and current Jira/JSM issue and comment visibility. Administrator access does not grant private review membership. Background work retains its authorizing user and checks current permissions rather than using a broader app privilege as a fallback.
AI receives bounded authorized evidence and rubric instructions. Ticket/model text cannot authorize app actions. Citations are validated, but semantic correctness and immunity to prompt injection are not guaranteed. Reviewers make the final decisions and submit their own assessments.
Operational logs exclude intentional ticket/review bodies and credentials. Opaque customer-linked identifiers and timing/status can remain personal or End-User Data; the SQR privacy section describes their handling. Permissions, data minimization, privacy redaction and fixed retention reduce exposure without promising anonymity or immediate deletion from platform backups.
Hosting, residency and third parties
Storage uses the host product's supported Forge residency and migration. This is not a guarantee of the location of every invocation, AI inference, platform log or vendor support interaction. Atlassian provides platform security and infrastructure; app-specific certifications must not be inferred from Atlassian's certifications.
Atlassian supplies the app platform. The separate support contact chain uses Cloudflare/Turnstile, Amazon SES and Google Workspace, as described in the shared privacy policy. The owner operates from Canada; SES is configured in Ohio and Cloudflare uses distributed Default placement. Provider processing may occur in the US and other countries under the shared transfer framework. SQR support uses only the Magnascale owner and the documented providers.
Magnascale accesses customer platform logs only when needed to troubleshoot and promptly deletes any temporary downloaded customer-log copies after the troubleshooting is complete. Retained bug/fix findings exclude raw log payloads and unnecessary customer identifiers. Platform-managed logs follow Atlassian's lifecycle.
Magnascale’s owner confirms that applicable online and offline data and copies, including temporary customer troubleshooting material, are encrypted. This describes an owner-confirmed operating practice, not an independently audited certification or verification of provider, account, device, or encryption-key settings. Temporary troubleshooting copies are processed and stored while they are in use.
Reporting and incidents
For SQR, support@magnascale.com is an accepted fallback to security@magnascale.com. Do not send private Jira ticket or review content, credentials or access tokens with an SQR security report; use a safe reproduction and brief impact description. The Magnascale owner is accountable for escalation under the stated support hours and response objectives; no separate backup staffing or 24/7 support is promised. Urgent suspected exposure is escalated immediately when identified. Applicable platform and legal incident obligations govern separately from ordinary support targets.
The owner coordinates containment, provider escalation and required notices, keeps the necessary incident record through the documented support channels, and limits shared diagnostic material to what is needed. No app-specific SOC 2, ISO 27001, Cloud Fortified, independent penetration-test or bug-bounty certification is claimed for SQR.