Checking permissions in Forge: when to use asUser and asApp
A Jira issue-editing example shows where user permissions, app permissions, and business rules need separate checks.
Read articleSOFTWARE ENGINEERING / APPLICATION SECURITY
Build with ambition.
Ship with confidence.
From Atlassian apps to business-critical software, we connect product engineering with penetration testing and application security.
Built for the teams building what’s next.
APPLICATION LIFECYCLE01 — 04
SECURITY
BY DESIGN
01 / DESIGN02 / BUILD03 / TEST04 / IMPROVEBY DESIGN
Engineering × Security
01 / SECURITY SERVICES
Understand the risk.
Make the next release stronger.
Practical security services that connect technical findings to the way your applications are designed, built, and operated.
01 ↗
Explore our testing approach Penetration Testing
Investigate how weaknesses in your applications and APIs could affect real users and business workflows.
APPLICATIONS / APIs / BUSINESS LOGIC02 ↗Vulnerability Assessment
Identify and prioritise weaknesses across an agreed set of assets, with context for remediation.
DISCOVERY / TRIAGE / PRIORITISATION03 ↗Security Architecture
Examine trust boundaries and data flows before design decisions become expensive to change.
THREAT MODELLING / DESIGN REVIEW04 ↗Application Security Services
Bring security requirements, review, and remediation into the software delivery lifecycle.
SECURE DEVELOPMENT / REVIEW / REMEDIATION02 / ATLASSIAN & FORGE
Good apps solve problems.
Great apps earn trust.
Bring workflows, integrations, and insights into the tools your teams already use. Plan security alongside functionality, from permissions and data flows to the application’s trust boundaries.
Explore Atlassian development01
Purposeful integrations
Connect business workflows and make information useful.
02
Permissions with intent
Understand who can access data, invoke actions, and cross a trust boundary.
03
Security through delivery
Bring architecture review and application testing into the development conversation.
03 / FROM THE ENGINEERING DESK
Ideas you can put to work.
What to check before putting a Forge Remote backend into production
Token verification is the first check. Caches, background jobs, and installation changes need attention too.
Read articleWhat does an OWASP-based penetration test actually cover?
An invoice-export example explains how to turn OWASP references into a scope, a coverage record, and useful findings.
Read articleSTART WITH THE RIGHT QUESTIONS
What are you building?
What needs protecting?
Tell us about your application, your users, and the decisions you need to make.
Discuss your project