Jira integration security, permissions, and data handling

XBOW Integration for Jira is an Atlassian Forge app. It runs in Atlassian’s Forge runtime and uses Forge hosted storage for installation-specific configuration and secrets.

Permissions

The XBOW app requires a few specific Jira permissions to work.

The app asks Jira for these scopes during installation:

Atlassian’s write:jira-work scope permits more actions than the integration uses. The app uses it to create Jira work items, post comments as the app rather than as a user, and write issue properties. The app does not delete work items and does not create worklogs. It does not read attachments.

The app calls XBOW Console APIs from the Forge backend. The Jira admin chooses the XBOW region during setup, and the app limits outbound XBOW API calls to the supported Console regions:

• US: https://console.xbow.com
• EU: https://console.eu.xbow.com
• SG: https://console.sg.xbow.com

XBOW controls the API version used by the app.

Data sent to Jira

The app writes XBOW finding content to Jira using your mapping.

You control how finding details are shared with Jira. Work items may include the name, summary, severity, evidence, impact, mitigations, and recipe steps for each finding.

Review your mapping before you enable data delivery to a production Jira project.

Data sent to XBOW

The app sends setup and workflow metadata to XBOW.

In unidirectional mode, the app creates Jira work items from XBOW findings but does not write Jira issue references or workflow state back to XBOW. Setup actions still call XBOW APIs to validate the token and connect the webhook.

In bidirectional mode, the app writes:

• Jira issue reference
• Mapped external workflow state

There is no mapping from Jira to the vulnerability lifecycle state of an XBOW finding, so the app cannot change that lifecycle state.

XBOW API token

The app stores the XBOW API token in Forge secret storage for the Jira installation.

The token field is write-only. The app does not show the token value after save.

The app validates a new token before storing it. If validation fails, the existing token remains in use.

Use a dedicated XBOW API token for this Jira integration. Revoke the token in XBOW if the integration should no longer have access.

Webhook security

XBOW sends webhook events to the app through a Forge web trigger URL.

The app verifies XBOW webhook signatures before processing events. It rejects unsigned events, invalid signatures, and stale timestamps.

The app processes signed finding events only when the finding organization matches the XBOW organization configured for the Jira installation.

Stored data

Forge secret storage stores:

• The XBOW API token used by this Jira installation to call XBOW APIs

Forge storage stores:

• Admin configuration
• Mapping configuration
• XBOW webhook signing public keys
• Webhook connection metadata
• Finding-to-Jira link records
• Jira issue-to-finding link records
• Recent event records
• Non-secret token status metadata

Jira issue properties store:

• XBOW finding ID
• Jira issue key, issue ID, and issue URL
• XBOW Jira app installation ID
• XBOW Jira app source marker
• XBOW Jira app event ID that created or repaired the link

Debug info and events

Debug information and event records hold only the information needed to troubleshoot problems.

The Events view stores the most recent 100 event records per installation.

Copyable debug information

The debug information includes setup and diagnostic detail:

• Your integration mode, XBOW region, organization ID, and API version
• Token status and validation timestamps
• The number of signing keys
• Webhook connection state, and the reason for any failure
• Your Jira site URL and cloud ID
• The mapped project and issue type
• Counts of labels and Jira metadata
• Identifiers and status for recent events, including finding IDs

Data excluded from debug information and events

Debug information and event records intentionally exclude sensitive data, for example:

• XBOW API tokens
• Webhook signing key material
• Raw Jira and XBOW payloads
• Finding content, including evidence, mitigations, and recipe text

The debug information lists the fields it excludes, so you can confirm the exclusions before you send it.

The debug panel and event records are not the only place this information appears. For information about the content included in Atlassian’s Forge runtime logs, see Application logs.

Application logs

The app writes operational metadata to Atlassian’s Forge runtime logs:

• Event, finding, installation, organization, and Jira issue identifiers
• Jira project key and issue type name
• Jira status and the mapped XBOW workflow state
• Integration mode, API version, and sanitized failure categories
• The configured XBOW region and Jira site URL

The logs do not intentionally include:

• XBOW API tokens or webhook signing key material
• Raw Jira and XBOW payloads, including upstream response bodies
• Finding content, such as finding titles, evidence, impact, mitigations, and recipe text
• Target names and target application URLs
• Jira comment bodies

Atlassian shares these logs with XBOW as the app vendor. Sharing is enabled by default when an app is installed on your site, and can include up to 60 days of log history. To review the logs, download a copy, or turn sharing off, open Connected apps in your Atlassian administration settings. See Manage your users’ third-party apps in Atlassian’s documentation.

Atlassian-hosted AI models

The app does not use Atlassian-hosted AI models. It declares no Forge LLM module and makes no AI model calls.

A newly installed app inherits your Atlassian administration’s default settings for AI model access. This setting has no impact on the functionality of the XBOW app since it does not use AI models.