Security policy and incident response

Publisher: Joao Duro De Matos (sole proprietorship), Kraków, Poland. Applies to Riskloop, Assetloop and Askloop. Security contact: security@studiowebworks.com. Last reviewed: 13 October 2026.

How the apps are built

• All apps run only on Atlassian Forge ("Runs on Atlassian"). There are no servers of ours, no external egress, and customer data stays in Atlassian-hosted storage.
• The apps store only Atlassian account ids for people, and report them to Atlassian's personal data API so closed accounts are removed.
• Each app asks only for the scopes it needs. The apps hold no secrets and never ask users for passwords or API tokens.
• Every release gets an independent code review (with a focus on permissions and injection) and deep testing (unit tests, lint, every screen in a browser) before it reaches production.
• Dependencies are checked with npm audit before each release and kept up to date.

Access and accounts

• One person develops and operates the apps. Two-step login is on for the Atlassian, Google and GitHub accounts used for this work, with strong unique passwords.
• Access to these accounts is reviewed every quarter. Workstations run supported, automatically updated operating systems and antivirus.
• Source code is kept in a private GitHub repository.

Reporting a vulnerability

Email security@studiowebworks.com with the app name, what you found and how to reproduce it. You will get a reply within 2 business days.

Incident response plan

1. Detect and record. Any report, Atlassian notice or unusual log entry is recorded with the time, the app and what is known.
2. Assess. Decide the severity (Critical, High, Medium, Low) using Atlassian's Marketplace security bug fix policy.
3. Contain. If customer data may be at risk, stop the affected function at once: deploy a fix or a version with the function switched off.
4. Notify. Tell Atlassian within 24 hours of confirming a security incident, through the Ecosystem support portal, and notify affected customers using Atlassian's incident and vulnerability notification templates.
5. Fix. Meet the Marketplace bug fix timelines (Critical and High vulnerabilities in Cloud apps within the policy's limits). Every fix goes through code review and testing before release.
6. Review. After the incident, write down the cause and what changed so it does not happen again.