Security overview for Webhooks Pro

Webhooks Pro is a Forge app. It runs inside Atlassian's Forge sandbox, declares only the scopes it needs, and sends data only to destinations a Jira admin has explicitly approved. There is no UX Software backend, no analytics, no telemetry.

This page is the security overview specifically for Webhooks Pro. For UX Software's company-wide policy that covers all our products, see Webhooks Pro security policy.

Webhooks Pro runs in Atlassian Forge. That gives us — and you — these baseline guarantees:

• Per-app sandboxing. Webhooks Pro cannot read other apps' data, and other apps cannot read Webhooks Pro's data.

• Declared scopes. Every Jira API the app uses is listed in the manifest.yml. Atlassian shows the scope list during install. We declare the minimum needed; we don't ask for write scopes we don't use.

• Per-host egress approval. The first time the app tries to reach a new external host, the Jira admin sees an approval dialog. No request goes out without admin consent.

• No long-lived shells, no SSH, no servers. The app runs as serverless functions invoked by Jira events.

• Only the URL you configured. Webhooks Pro never sends data to UX Software, to telemetry endpoints, to error trackers, or to any third party.

• HTTPS by default. If you enter an http:// URL, you accept transport without TLS — that's a deliberate choice on your side.

• HMAC signing. Every webhook can hold a per-webhook signing secret. When set, every delivery includes X-Webhook-Signature: sha256=<hex> over the exact request body bytes. See HMAC signing details.

• Headers stay literal. What you typed in the form is what's sent. Placeholders that resolve from issue data are URL-encoded in URLs and JSON-escaped in bodies.

• Signing secrets are stored via Forge storage APIs and never returned to the UI after save. The form shows a "Secret set" lozenge but no value. Rotation is one-way — entering a new value overwrites the old, immediately.

• No secrets in source control. API tokens, signing keys, and any customer-supplied values live only at runtime.

• Don't put secrets in placeholders. Anything pulled from a Jira issue field (custom field, summary, description) appears in the delivery log. Static Authorization tokens belong in literal header values; they're stored in the app's data and not echoed in logs after save.

• Issue / event payloads are the data Jira passes to us when the events you ticked fire. We render the payload template, send it once, and store the request and response in the delivery log.

• Delivery logs include the full rendered request body and the receiver's response. They live inside your Jira tenant. Retention is configurable on Settings retention.

• Body compression. Bodies above a small threshold are gzipped before storage; the log viewer transparently decompresses for display.

• No analytics. Zero third-party SDKs (no Segment, Amplitude, Mixpanel, GA, …).

• No error trackers. No Sentry, no Datadog RUM, no LogRocket, no session replay.

• No usage telemetry to UX Software. We do not call home — installs, settings, payloads, all of it stays inside your tenant.

• No background data collection. The app only acts when a configured event fires or a schedule ticks.

• No employee access to your data. UX Software employees cannot log into your Jira, cannot read your delivery logs, and cannot read your signing secrets.

• No code outside the Marketplace upgrade channel. You receive new versions via the standard Atlassian Marketplace upgrade path. Nothing is shipped as side-loaded code, post-install scripts, or remote configuration.

Webhooks Pro inherits the certifications of the Atlassian Forge platform — SOC 2, ISO 27001, GDPR support, and others as published in the Atlassian Trust Center. UX Software does not hold separate independent certifications for the Forge runtime — there is no separate runtime to certify.

For a per-product breakdown of what data we process and where, see Data security statement and How Webhooks Pro handles your data.

If you believe you found a security vulnerability in Webhooks Pro, report it privately:

• Email: support@ux-software.com

• Subject prefix: [security]

Please do not disclose publicly before we have had a reasonable chance to investigate and fix.

What to expect:

Full reporting policy, scope, and safe harbor are in Webhooks Pro security policy.

• Data security statement — what data Webhooks Pro processes, where it lives, retention.

• How Webhooks Pro handles your data — privacy specifics.

• Webhooks Pro subprocessors — the (very short) list.

• HMAC signing details — algorithm, header, verification examples.

• Forge platform and scopes — what Jira permissions the app declares and why.

• Data residency — how residency is determined for Webhooks Pro.