Security

Last updated 2026-09-03. This page describes how CaseRun is built and what that means for your data.

Architecture: there is no CaseRun server

CaseRun runs entirely on Atlassian Forge. The backend is Forge functions and Forge SQL (Atlassian-hosted storage), both inside Atlassian's infrastructure and scoped to your installation. We operate no servers, no databases and no analytics of our own, so there is no vendor-side system that could hold or leak your data.

As the vendor we have no console or API for reading your installation's data. When you contact support we only see what you choose to send us.

Permissions

Scope	Why
read:jira-work	To know which project the app was opened in and to resolve issue keys you link tests to
read:jira-user	To attribute a test run to the account that made it

Both are read-only. CaseRun cannot create, modify or delete Jira issues, and it requests no other product or external scopes.

Data handling

• All app data (test cases, steps, cycles, runs, links, ingest log) is stored in Forge SQL for that installation.
• The only personal identifier stored is the Atlassian account ID — no names, emails, avatars or IP addresses.
• No data is transmitted to any third party. The app makes no outbound network calls.
• Application logs contain the handler name, project key, duration and row counts — not the content of your tests.
• Because storage is Forge-hosted only, the app is eligible for Atlassian's data residency program and follows the pinning of your Jira site.

The full data inventory and retention behaviour is on the privacy page.

The CI ingest endpoint

CaseRun exposes one inbound endpoint — a Forge web trigger — so your CI can post JUnit XML. The URL contains a secret token and is generated per installation. Treat it as a credential and keep it in your CI secret store; if it is exposed, press Rotate URL in the app's CI tab and the old address stops working immediately. The endpoint only accepts test results; it cannot read data back out.

Development practices

• Every change is verified by two automated suites before deploy: a UI harness that drives the real front-end bundle, and a self-test web trigger that exercises every server path against real Forge SQL and cleans up after itself.
• Development-only tooling (seed data, self-test) is gated behind an environment variable that does not exist in production, so those endpoints return 404 there.
• Runtime dependencies are limited to the Atlassian Forge SDK and React; there is no third-party analytics, tracking or logging SDK in the bundle.

Reporting a vulnerability

Email support@caserun.dev with the details and, if possible, a way to reproduce. We aim to acknowledge within one business day. Please do not publicly disclose an issue before we have had a chance to fix it.

You can also report through Atlassian's channels for Marketplace apps, and we will work with Atlassian on any issue that affects customers.

What we do not claim

CaseRun is a small, focused product. We hold no SOC 2, ISO 27001 or comparable certification today, and we say so plainly rather than implying otherwise. The security posture above comes from the architecture — no vendor-side servers or data — not from a compliance programme.