HOURBLUE ENTERPRISE

Security

Security is part of how we design, build, and operate our enterprise products. Before each Marketplace release, we will publish accurate product-specific information about permissions, data handling, and security controls.

Report a security concern

Please do not include sensitive credentials or exploit details in an initial email. Tell us the affected product, a clear summary, and a safe way to contact you; we will respond with an appropriate secure channel if needed.

DBML Diagrams for Confluence

Where it runs. The app is built on Atlassian Forge and runs entirely on Atlassian infrastructure: no backend of ours, no storage, no outbound requests and no analytics. It is eligible for Atlassian's Runs on Atlassian programme.

Permissions. One: read:page:confluence, to read the page or blog post a diagram macro sits on. The app never writes to your content and never reads other pages.

Why the app declares unsafe-eval. Diagrams are laid out by Graphviz, compiled to WebAssembly and shipped inside the app. Browsers need the unsafe-eval content-security-policy directive to instantiate WebAssembly, and Atlassian Forge does not accept the narrower wasm-unsafe-eval value. No application code evaluates strings, and the app loads no code from anywhere but its own bundle.

Data residency. The app stores no end-user data, so none of your data is in scope for residency with us. Page content stays in your Confluence site and follows the data residency you have configured with Atlassian.

Fixing what we find. We work to Atlassian's Marketplace deadlines for app vulnerabilities: 10 days for critical, 4 weeks for high, 12 weeks for medium and 25 weeks for low severity.

DBML Diagrams for Jira

Where it runs. The app is built on Atlassian Forge and runs entirely on Atlassian infrastructure: no backend of ours, no storage, no outbound requests and no analytics. It is eligible for Atlassian's Runs on Atlassian programme.

Permissions. One: read:jira-work, to read the description and comments of the issue the panel is on. The app reads as the person viewing the issue, so it never sees more than they can; it reads only the issue being viewed, and never writes to your issues.

Why the app declares unsafe-eval. As for DBML Diagrams for Confluence: Graphviz, compiled to WebAssembly and shipped inside the app, needs the unsafe-eval directive to instantiate, and Atlassian Forge does not accept the narrower wasm-unsafe-eval. No application code evaluates strings, and the app loads no code from anywhere but its own bundle.

Data residency. The app stores no end-user data, so none of your data is in scope for residency with us. Issue content stays in your Jira site and follows the data residency you have configured with Atlassian. The only things kept anywhere are Jira's own record of which issues the panel was added to, and a remembered diagram height in each viewer's browser.

Fixing what we find. The same Marketplace deadlines apply: 10 days for critical, 4 weeks for high, 12 weeks for medium and 25 weeks for low severity.

Responsible disclosure

We welcome good-faith reports. Please avoid privacy violations, service disruption, and accessing or modifying data that does not belong to you.