Showdown — Security Information
This document describes the security posture of Showdown - Planning Poker for Jira Sprint Estimation, the Atlassian Marketplace app by Taskhooker Pty Ltd. It is intended for security reviewers at customer organisations evaluating Showdown for installation.
Platform
Showdown is built entirely on Atlassian Forge, Atlassian's hosted application platform. Taskhooker operates no third-party servers and runs no code outside Atlassian's network. The app declares no external egress and no webtriggers: no data is transmitted outside Atlassian's infrastructure — the app is eligible for Atlassian's Runs on Atlassian designation by architecture.
What this means in practice
- Every function call executes in Atlassian's sandboxed Node.js runtime
- Every storage write goes to Forge Key-Value Store (encrypted at rest, Atlassian-managed, tied to your site)
- The manifest declares no
permissions.externalentries — there is no host the app could call even if it tried - The app cannot run code on your servers or your users' machines
Permissions
Showdown requests four Atlassian scopes:
| Scope | Reason |
|---|---|
read:jira-work | Search and read the work items selected for a session (quick-pick or JQL), their context fields, and reference work items at each scale value |
write:jira-work | Save final estimates to the chosen number field — written as the facilitator, so Jira permissions apply |
read:jira-user | Show participants' display names in the session roster and vote lists |
storage:app | Persist sessions, votes, rosters, bucket assignments and finals in Forge Key-Value Store |
That is the complete scope list. The app requests no administrative scopes and no outbound network permissions.
Authentication
All user-facing Jira access is authorised by Atlassian's identity platform inside Forge. Final estimates are written with Forge asUser() as the facilitator — a facilitator cannot save an estimate to a work item they could not edit in Jira directly. The app does not consume customer-supplied API keys and stores no credentials anywhere.
Secret handling
None. The app stores no secrets, no API keys, no OAuth tokens, no client credentials and no encryption keys. There is nothing to rotate, revoke or audit on the secrets side.
Vote integrity and access control
- Votes are held server-side. Other participants' vote values are never returned to any browser before the reveal (Interactive) or before voting is closed (Async). In Async mode, values stay hidden even from the facilitator until close.
- Facilitator-only mutations are enforced server-side. Reveal, re-vote, setting finals, saving, closing and deleting are checked against the session creator's identity in the backend — not just hidden in the UI.
- Each vote is stored as its own record per session, work item, round and voter, preventing write races and cross-voter tampering.
Data stored
Forge Key-Value Store on the customer's site holds: session settings; snapshots of the selected work items' keys, summaries and types; votes (scale value, voter's Atlassian account id and display name, timestamp); the participant roster (account id, display name, spectator flag); bucket assignments; and finals. No emails, no credentials, no content beyond that. Deleting a session deletes its votes, roster and buckets; uninstalling the app removes app storage per Forge platform behaviour. See the privacy policy for the full data-handling description.
Vulnerability reporting
Security vulnerabilities can be reported via the Taskhooker support portal. We commit to acknowledging reports within 5 business days and disclosing patches via the Marketplace "What's new" section.
Showdown is a solo-developer product. We do not currently operate a paid bug bounty programme.
Compliance
Showdown inherits the security and compliance posture of the underlying Atlassian Forge platform. Atlassian Forge is certified under:
- SOC 2 Type II
- ISO 27001 / 27017 / 27018
- PCI-DSS (for the platform itself; Showdown does not handle payment data)
- GDPR and CCPA compliance commitments
Showdown itself does not have independent certifications. The app code is reviewed by Atlassian as part of the Marketplace listing approval process.
Audit & change history
For your records, every code change to Showdown is reflected in the What's new section of the Marketplace listing for each version. The Marketplace partner portal also exposes a full version history for compliance audits.