Security Policy

Last updated October 28, 2026

Vendor and app

Inbound Webhook Router for Jira is built and maintained by CREWLABS.IO.

Architecture

Inbound Webhook Router for Jira is a Forge-only app. It runs on the Atlassian Forge platform (Node.js 22.x runtime). It has no external server and no external backend, and no data is transmitted outside Atlassian Cloud.

Permissions (scopes)

The app requests only these scopes:

• read:jira-work
• write:jira-work
• storage:app

Data storage

All app data is kept in Atlassian Forge storage (Key-Value Store) inside your own Atlassian Cloud instance. The app stores:

• Router configuration: the destination project, default issue type, summary prefix, and the shared secret set by your administrator.
• Deduplication keys: SHA-256 hashes of provider delivery IDs, with timestamps.

Authentication of inbound webhooks

• The inbound endpoint is a Forge web trigger that accepts POST requests only.
• Every request must present the shared secret configured by an administrator. The preferred method is the x-webhook-token header; a Bearer token in the Authorization header or a token query parameter are accepted as alternatives.
• The presented value is compared with the configured secret using SHA-256 and a timing-safe comparison.
• If no secret has been configured, or the secret does not match, the request fails with HTTP 401 and no Jira issue is created.

Admin access and secret handling

• The admin settings page and its backend calls require the Jira ADMINISTER permission.
• The shared secret is never returned by the admin page. The page receives only a hasSecret true/false value to show whether a secret is configured.

Issue creation

For each authenticated webhook, the app creates a Jira issue through the Jira REST API in the project your administrator selected. The issue description contains the webhook payload as JSON, truncated at 30,000 characters, plus the source IP/host taken from the webhook request headers.

Analytics, tracking, and subprocessors

The app contains no analytics and no tracking. Crewlabs uses no subprocessors for this app beyond Atlassian's own platform hosting. See the Privacy Policy for details.

Reporting a vulnerability

If you believe you have found a security issue in Inbound Webhook Router for Jira, please report it to support@crewlabs.io. Include a description of the issue and the steps needed to reproduce it.

Changes to this policy

If this policy ever changes, the updated version will be posted at this same URL with a new "last updated" date.

Contact

Security questions can be sent to support@crewlabs.io.