Independent security review for Atlassian apps.

Deep, AI-assisted source analysis of your Jira, Confluence, Forge, Connect and Data Center apps — every finding reviewed by a human before it reaches you. No false-positive noise, just prioritized, reproducible vulnerabilities.

See how it works

◆ Every finding is human-verified — we never ship an unreviewed alert.

A+POSTURE

Stored XSScustom-field template

Broken access control/rest/gridplugin/1.0

SSRFdata-source fetch

COVERAGE JiraConfluenceForge appsConnect appsData Center pluginsBitbucket

THE PROCESS

A security team's workflow, not a scanner's dump.

Your app package is preserved, analyzed in depth across every source file — including decompiled bytecode and Velocity templates — then triaged by a reviewer before anything is published to you.

⬆

Submit your app

Upload the plugin package (.jar / .obr) or connect the repo. We preserve an immutable copy and unpack every nested artifact.

◎

Deep AI analysis

Multi-pass discovery across the full source tree — REST endpoints, servlets, templates, bytecode — mapping real attack paths, not pattern matches.

✓

Human review

A reviewer validates every candidate against the evidence. False positives are dismissed. You only ever see confirmed issues.

▤

Prioritized report

Each finding ships with severity, reproduction steps and remediation, delivered within SLA and tracked in your workspace.

WHAT WE LOOK FOR

The vulnerability classes that actually hit Atlassian apps.

Injection & XSS

SQLi, stored/reflected XSS, Velocity & template injection, command/OS injection.

Access control

Broken authZ on REST/servlet endpoints, IDOR, missing permission checks, privilege escalation.

Request forgery

SSRF in webhooks & data sources, CSRF on state-changing actions, missing atl_token.

Secrets & config

Leaked tokens, insecure deserialization, path traversal, sensitive data in logs.

PRICING

Annual plans. One workspace, your whole app portfolio.

Each plan includes a security-credit allowance that covers reviewed findings by severity. Prices are billed annually.

Basic

$3,000 / year

For a small team shipping one or two apps.

Up to 2 applications
Full AI + human review pipeline
Prioritized reports with repro steps
$3,000 security-credit allowance

GrowthPOPULAR

$7,000 / year

For a growing marketplace vendor.

Up to 5 applications
Everything in Basic
72-hour finding SLA
$7,000 security-credit allowance

Unlimited

$15,000 / year

For a full portfolio under continuous review.

Unlimited applications
Everything in Growth
Priority review queue
$15,000 security-credit allowance

See the reviewer workspace.

Explore a sample customer account with live findings, analytics and reports — no sign-up.