Checking permissions in Forge: when to use asUser and asApp
A Jira issue-editing example shows where user permissions, app permissions, and business rules need separate checks.
Read articleTHE ACTIOTECH BLOG
Engineering insight.
Security in practice.
Practical thinking on Atlassian Forge, application security, OWASP, and the responsible use of AI in testing.
What to check before putting a Forge Remote backend into production
Token verification is the first check. Caches, background jobs, and installation changes need attention too.
Read articleWhat does an OWASP-based penetration test actually cover?
An invoice-export example explains how to turn OWASP references into a scope, a coverage record, and useful findings.
Read articleUsing AI during a penetration test
What a testing team still needs to verify when AI helps with planning, triage, or report writing.
Read articleTesting an AI assistant inside a Jira app
Follow a project-summary request through retrieval, caching, and tool calls to find the permission checks that matter.
Read articleSTART WITH THE RIGHT QUESTIONS
What are you building?
What needs protecting?
Tell us about your application, your users, and the decisions you need to make.
Discuss your project