/
Security Assessment of QuotaWatch: Penetration Testing & Infrastructure Overview

Security Assessment of QuotaWatch: Penetration Testing & Infrastructure Overview

Overview

This document outlines the security posture of QuotaWatch regarding external penetration testing and vulnerability management.

1. Forge-Native Architecture

QuotaWatch is built using the Atlassian Forge framework. Unlike traditional "Connect" apps or external integrations, QuotaWatch is a Forge-native application. This means:

  • Zero External Hosting: The application code does not run on independent servers, AWS instances, or private clouds.

  • Atlassian-Managed Infrastructure: The code executes entirely within Atlassian’s secure, serverless runtime environment.

  • No Data Egress: All data storage (via Forge KVS) and processing occur within the Atlassian Cloud boundary.

2. Shared Responsibility Model

Because the application is hosted by Atlassian, the responsibility for infrastructure security, platform hardening, and network-level penetration testing is managed by Atlassian.

Atlassian Platform Security & Audits

Atlassian performs rigorous, regular third-party security audits and penetration testing on the Forge platform. These include:

  • SOC2 & SOC3 Compliance

  • ISO/IEC 27001 & 27018 Certification

  • Continuous Internal & External Penetration Testing of the Forge runtime and storage layers.

For more information, please refer to the Atlassian Trust Center.

3. Vulnerability Surface Analysis

An independent penetration test of QuotaWatch is not applicable due to its architectural design:

  • No External Endpoints: The app does not expose any public URLs, REST APIs, or listening ports to the open internet.

  • No Inbound Attack Surface: Since there is no way to "reach" the app from outside the Atlassian ecosystem, there is no surface area for a traditional external penetration test to target.

  • Isolation: Each installation runs in a secure, multi-tenant isolate that is logically separated from other apps and tenants.

4. Internal Security Controls

While external infrastructure testing is handled by Atlassian, we maintain internal code-level security:

  • Static Code Analysis: All code is scanned for vulnerabilities before deployment.

  • Least Privilege: The app operates with the minimum required scopes (read:jira-work, storage:app).

  • Platform Security: We leverage Forge’s built-in protection against common web vulnerabilities (e.g., XSS, CSRF) by using the Forge UI Kit and secure resolvers.

5. Conclusion

Independent penetration testing of QuotaWatch is not required. The application’s security is guaranteed by the underlying Atlassian Forge platform, which undergoes regular, world-class security validation. The app possesses no independent external attack surface, as it resides entirely within the managed Atlassian Cloud infrastructure.

Pro-Tip for Confluence:

  • Use the Info Macro (Blue info box) at the top of the page for the "Zero External Hosting" point to make it stand out.

  • Link the phrase "Atlassian Trust Center" to https://www.atlassian.com/trust so auditors can verify the platform's certifications themselves.