Security

Reporting a vulnerability

Email security@ryanit.io. Please include enough detail to reproduce the issue. If you would rather not put details in email, send a short note and we will arrange something.

What to expect: an acknowledgement within two working days, an assessment within five, and updates until it is resolved. If we disagree that something is a vulnerability we will say so and explain why, rather than going quiet.

We do not run a paid bug bounty. We will credit you in the release notes if you would like us to, and we would rather hear about a problem than not.

Safe harbour

We will not pursue or support legal action against anyone who reports a vulnerability in good faith, provided you avoid privacy violations, service degradation and data destruction, test only against sites you own or have permission to test, and give us reasonable time to fix the issue before disclosing it publicly.

Please do not test against another organisation's Confluence site. If you need an environment, tell us and we will help.

How the app is built

Winnow is a Forge app. That is a security property rather than an implementation detail: Forge apps run on Atlassian's infrastructure with permissions declared in a manifest that Atlassian enforces.

No external network access

The app declares no egress permissions, so the platform will not let it contact any external host. There is no server of ours for your content to reach. This is what qualifies Winnow for Atlassian's Runs on Atlassian badge.

Read-only, and only two scopes

read:page:confluence and read:space:confluence, plus app storage. Winnow never writes to your content: a finding links an editor to the page rather than editing it for them. It cannot create, modify, move or delete anything.

Space by space, at your choice

Winnow reads a space only when an administrator both switches it on in the app and grants the app viewer access to that space in Confluence. It will not, and technically cannot, grant itself access.

No credentials

Winnow never sees a password, API token or personal access token. It authenticates as itself through Forge.

Language models stay inside Atlassian

Page text is analysed through Atlassian's Forge LLMs API, which runs models on Atlassian infrastructure. Content is not sent to a model vendor we have chosen, and not to us.

Data minimisation

Pages are truncated before analysis and discarded afterwards. Only the short quote that justifies a finding is kept. No user identifiers are read at all.

Permissions we deliberately do not ask for

Winnow does not request write access, admin scopes, user directory access, or the ability to act on behalf of a user. If a future version needs a new permission, Atlassian will require your administrator to review and accept it before that version installs — a version with new scopes cannot roll out silently.

What we do not have

We think it is more useful to say this plainly than to imply otherwise. Ryan IT Solutions holds no SOC 2 report, no ISO 27001 certification and no completed CAIQ. We are a small publisher, and those programmes largely certify controls over data held by the vendor — of which, here, there is none. The Runs on Atlassian designation is the meaningful assurance for an app of this shape, and it is verified by Atlassian from the app's manifest rather than asserted by us.

Incidents

If we become aware of a security incident affecting the app, we will contact affected customers directly at the technical contact on their Marketplace subscription, and publish a note here. Because we hold no customer data, an incident on our side cannot expose your content — but we would still tell you what happened.