Security

Last updated: 12 November 2026

How our Jira apps are built

• Built on Atlassian Forge and hosted by Atlassian. No Rowmill servers.
• No external network calls and no app-owned storage. Data stays in your Jira site.
• Smallest possible permissions. Rowmill Table Field requests one scope: reading its own field's column settings.
• Dependencies are checked with npm audit before each release.

Report a vulnerability

Email hello@rowmillhq.com with "Security" in the subject. Include the app, steps to reproduce and impact.

• We reply within 2 business days.
• We share a fix plan within 10 business days.
• Please give us reasonable time to fix before disclosing publicly. We will credit you if you want.

Incidents

If a defect affects customers, we ship a fixed Forge version and email affected customers where we can identify them through Marketplace licence data.