Security

Last updated: 31 August 2026.

Reporting a vulnerability

Email security@winnowtools.com with enough detail to reproduce the issue. Please do not open a public issue or post details anywhere until we have had a chance to fix it.

What you can expect:

• an acknowledgement within 2 business days;
• an assessment and a planned fix date within 7 days;
• updates as the fix progresses, and a note when it ships;
• credit in the release notes if you want it.

We are a small team and we do not run a paid bug bounty. We would rather say that plainly than imply a reward that does not exist.

Safe harbour

If you act in good faith — you avoid privacy violations, data destruction and service disruption, you only test against your own site, and you give us reasonable time to fix the issue before disclosing it — we will not pursue any action against you for the research itself.

How our apps are built

Our apps run on Atlassian Forge, inside Atlassian's own infrastructure. We operate no servers of our own, so there is no separate backend to attack and no copy of your data outside Atlassian.

• Egress is restricted at the platform level. Notify for Google Chat can reach exactly one host, chat.googleapis.com, and the platform prevents it from contacting anything else. This is enforced by Atlassian, not by our own code.
• Read-only access to Jira. The app requests read:jira-work and read:jira-user. It cannot modify or delete anything in your site.
• Data stays in Forge storage. Rules and a short delivery log live in Atlassian's hosted storage, scoped to your site. Because the app uses only Forge storage, it supports Atlassian data residency.
• No issue content is retained. Summaries, descriptions and comments pass through and are not stored.
• Transport is encrypted. All traffic to Google Chat is over HTTPS.

How we build and how we respond

The practices behind the summary above — our release gate, how secrets are handled, what the logs contain, and the step-by-step plan we follow when a security issue is reported — are written down in full: Security practices and incident response.

What we do not claim

We have not commissioned an external penetration test, and we do not hold SOC 2 or ISO 27001 certification. Saying so is more useful to you than a vague reassurance. If your procurement process needs either, write to us and we will tell you honestly where we stand rather than guess.