Security

Reporting a vulnerability

Email security@lukany.co. We acknowledge reports within two business days and tell you what we found and when it will be fixed. Please give us reasonable time to fix an issue before publishing it, and do not access data that is not yours while testing. We do not run a bug bounty program.

Our security.txt carries the same contact.

Where the app runs

• Standup Arcade is built on Atlassian Forge and runs entirely inside Atlassian's infrastructure, within the customer's own Atlassian site. Lukany operates no servers for it and has no access to a customer's data.
• It makes no outbound network requests and declares no external domains. It is eligible for Atlassian's Runs on Atlassian designation.
• Hosting, network security, encryption at rest and in transit, tenant isolation and data residency are provided by Atlassian's platform, under Atlassian's own certifications. Lukany holds no separate certifications.

How the app is built

• It acts as the user, not as itself. Every read of Jira runs with the permissions of the person using the app, so it can show only what that person may already see, including issue-level security. It never falls back to app-level permissions when a user-level read is refused.
• Least privilege. It requests only granular Jira scopes, each tied to a feature: reading boards, sprints and issue cards; moving an issue between columns on the user's behalf; its own storage; and Atlassian's privacy-reporting API.
• Every backend function checks the license first, before it reads or writes anything.
• Everything written to storage is validated and rejected rather than repaired; a caller can only act on a board that Jira lists for the project the page was opened in.
• Data minimisation. Only Atlassian account IDs and standup timings are stored. Names, email addresses and avatars are never stored; what Jira returns beyond what is needed is stripped before it reaches the browser. Logs contain counts, never an account ID.
• Dependencies are audited on every release; the app ships with no known vulnerabilities in its production dependencies.

Personal data

What the app stores and how a person is erased is in the Privacy Policy. In short: the app reports the account IDs it holds to Atlassian's privacy API weekly and erases anyone whose Atlassian account has been closed.

This website

lukany.co is a static site on Cloudflare with no analytics, no cookies of its own and no forms that store data. See the Privacy Policy.