Engineering insight. Security in practice. on Actiotech | Software engineering & application security

Checking permissions in Forge: when to use asUser and asApp

Tue, 10 Nov 2026 09:00:00 +0530

A Forge app works perfectly when you test it as a Jira administrator. You switch to an ordinary project member, try the same action, and get a permission error. It can be tempting to change the API call from asUser() to asApp() and move on.

What to check before putting a Forge Remote backend into production

Tue, 10 Nov 2026 09:00:00 +0530

Suppose two customers use your reporting app. Both have a report numbered 42. The database keeps their records separate, but the remote backend caches a generated report under the key report:42.

What does an OWASP-based penetration test actually cover?

Tue, 10 Nov 2026 09:00:00 +0530

“We need an OWASP test before launch.” It’s a reasonable request, but the next conversation needs to be about the application: which users it serves, what they can do, and what would go wrong if a control failed.

Using AI during a penetration test

Tue, 10 Nov 2026 09:00:00 +0530

An AI tool reads an API specification and suggests a possible access-control problem. That might be a useful lead. Before it belongs in a penetration test report, someone needs to establish whether the endpoint exists in the tested version, whether the suspected behaviour is reachable, and what actually happens when it is tested.

Testing an AI assistant inside a Jira app

Tue, 10 Nov 2026 09:00:00 +0530

Imagine an assistant that summarises a Jira project and offers to create follow-up tasks. In a demo, it reads the issues, writes a helpful summary, and creates a task when asked. Everything appears to work.