Hourward — security

Last updated 27 August 2026

This page describes how the app is built, what it can reach, and how to report a problem. What it stores and why is a separate document: privacy and data handling.

The short version

Hourward is a Forge app. It runs on Atlassian’s infrastructure, inside your Atlassian site’s own region, and it has no server, no database and no network of its own. There is nowhere for your data to go, because the app declares no permission to send it anywhere.

Where it runs, and what it can reach

Everything — the code, the storage, the requests — runs on Atlassian’s Forge platform. Growing Peas operates no server, no database, no queue and no third-party service in the path of your data.

The app declares no egress permission. The Atlassian scopes named read:app-system-token and read:app-user-token, which are what let a Forge app send data to an external address, are deliberately absent from its manifest, and so is any external.fetch declaration. Atlassian’s own tooling verifies this: the app is eligible for the Runs on Atlassian programme, and Atlassian notifies your administrators if an update ever changed that. Nothing the app holds can leave your tenant, and that property is enforced by the platform rather than promised by the developer.

The full set of permissions the app asks for is four scopes, and each one is there for a named reason.

Administrative scopes are refused on purpose. In particular manage:jira-configuration, which would let the app change your site’s time tracking provider by itself, is not requested; the app’s admin page points at Jira’s own setting instead.

Encryption and data residency

Traffic between your browser, the app and Jira runs over TLS, terminated by Atlassian. App storage is Atlassian’s Forge storage, encrypted at rest by Atlassian and held in the region your Atlassian site is in — the app never chooses a region, moves data between regions, or copies it out.

The bulk of what Hourward handles is never stored by the app at all: worklogs are written into Jira, where your issues already are, and read back from Jira each time a screen is drawn.

Who can read what

Hourward reads Jira as the person using it, never as itself. An issue Jira would not show you is an issue whose hours Hourward does not show you either — and when a read is refused or incomplete, the app says so rather than quietly presenting a smaller total as if it were the whole one.

Approving a timesheet is limited to the account ids a Jira administrator names on the app’s admin page. Nobody can approve their own week, approver or not.

Credentials and secrets

The app holds no credentials. It has no API key, no service account, no password and no token of its own to leak: calls to Jira are authenticated by the Forge platform, on behalf of the signed-in user. There is no login to Hourward, so there is no Hourward password anywhere, and no session for an attacker to steal.

How it is built and changed

• Three runtime dependencies, all published by Atlassian: @forge/api, @forge/kvs, @forge/resolver. A small dependency tree is the cheapest supply-chain control there is, and this one is deliberate.
• Every change runs a full check before it can land — lint, formatting, TypeScript, the test suite and a production build, on GitHub Actions, on every push and every pull request.
• The test suite includes security-relevant checks, not only feature tests: one writes through every path that touches storage and then searches the entire store for a display name or an email address, so the “no names in storage” claim is verified rather than asserted.
• The source repository is private, and access to it, to the Atlassian developer account and to the Marketplace partner account is limited to the one developer, each with two-step verification enabled.
• Runtime patching is Atlassian’s. Forge manages the Node runtime and the platform underneath it; there is no host, container or operating system for Growing Peas to patch. Dependency updates are applied by re-running the checks above and redeploying.

Reporting a vulnerability

Write to [email protected]. Please include what you found, how to reproduce it, and how you would like to be credited.

• Reports are acknowledged within five working days.
• You will get an assessment, and a fix or a plan, within thirty days of the acknowledgement.
• Good-faith research is welcome and will not be met with legal action. Please test against your own Atlassian site, not someone else’s, and do not access, modify or exfiltrate data that is not yours.
• Please give the fix a chance to ship before publishing.

There is no bug bounty — this is a one-person business, and paying one honestly is not something it can promise.

Vulnerabilities in the Atlassian platform itself belong to Atlassian’s own programme, at atlassian.com/trust/security/bug-bounty.

Incidents

If a security incident affects customer data, affected administrators are contacted by email at the address on the Marketplace account, without waiting for the investigation to finish, and told what is known, what is not, and what to do. Where the incident is a personal-data breach under the GDPR, the Belgian Data Protection Authority is notified within 72 hours.

Certifications

Growing Peas holds no security certification of its own — SOC 2, ISO 27001 and their equivalents are audits a one-person business does not carry. What underlies the app is certified: Hourward runs entirely on Atlassian’s Forge platform, whose compliance programme is published at atlassian.com/trust/compliance. The honest summary is that the security of your data here rests on Atlassian’s infrastructure and on the app’s refusal to take your data off it, rather than on an audit of Growing Peas.

Contact

Security reports — [email protected]
Anything else — [email protected]