Link Health - Broken Link Checker for Confluence · by Basis Ventures

Security Policy

Last updated: 6 October 2026

This policy describes how the Link Health - Broken Link Checker for Confluence app (the "App") is secured: where it runs, what it can reach, what it stores, who can use it, and how to report a security concern. It is a companion to the Privacy Policy, which covers what data the App handles and why; this document covers how that data is protected.

The short version. The App is an Atlassian Forge app with a deliberately small attack surface. It runs on Atlassian's own infrastructure, requests only read-only Confluence scopes, declares no external hosts and so can make no request outside Atlassian, keeps its data in Forge storage scoped to a single installation, and exposes its pages to Confluence administrators only. The publisher operates no servers for this App, holds no copy of customer content, and has no credentials that could reach a customer site.

1. Where the App runs

The App is built on Atlassian Forge. Its functions execute in Atlassian's managed, sandboxed runtime; its user interface is rendered by Atlassian's UI Kit inside Confluence; and its storage is Atlassian-hosted Forge storage. There is no publisher-operated backend, database, queue or CDN in the App's data path. Platform-level controls — isolation between apps and tenants, encryption in transit and at rest, patching of the runtime, and physical and network security — are provided and operated by Atlassian under its own security program. The App inherits those controls rather than re-implementing them.

2. Egress: what the App can reach

Nothing outside Atlassian. The App's manifest declares no permissions.external block and no remotes block. On Forge, an app cannot make a network request to any host it has not declared, so this is enforced by the platform, not by the App's good behaviour. It is the reason the App is eligible for Atlassian's Runs on Atlassian designation, which is visible on its Marketplace listing.

A practical consequence: the App does not check external links, because doing so would require reaching external hosts. Those links are reported as skipped on screen rather than silently treated as healthy.

3. Permissions and scopes

Scope	Why the App needs it
`read:space:confluence`	To list spaces and read space metadata during a scan
`read:page:confluence`	To read page bodies during a scan so links can be extracted and checked
`storage:app`	To keep scan results and settings in the App's own Forge storage

All Confluence scopes the App holds are read-only. It requests no write, delete or administrative scope, and it holds no scope for any product other than Confluence. The App therefore cannot modify, move or delete customer content even if it were compromised. Adding a scope would change the App's manifest and would be surfaced to administrators as a permission change requiring consent.

4. Authentication and access control

Identity is Atlassian's. The App has no accounts, passwords or sessions of its own. Every request arrives through Forge with the Atlassian identity of the calling user and the context of the installation.
Administrators only, at the interface. Both of the App's pages declare an administrator display condition, so they do not render for non-administrators.
Authorization is enforced on the server, not only in the interface. Every space-scoped operation — starting a scan, reading results, changing the ignore list, arming the daily re-scan — first verifies that the calling user can access that space, using a read performed as that user. A request for a space the user cannot see is refused before any elevated read happens. This is what prevents a caller who bypassed the interface from reading titles or links from a space they are not permitted to open.
Licence gate. Starting new work requires an active subscription; results already gathered remain readable so a lapsed subscription degrades gracefully rather than locking data away.

5. Data at rest

The App stores scan results, the per-space ignore list, the daily re-scan setting, and a single last-selected-space preference. All of it lives in Atlassian-hosted Forge storage scoped to the installation: readable only by this App, only for that installation, and encrypted at rest by Atlassian. The publisher cannot read it. No customer content is ever written to a location outside Atlassian, because the App has no such location. When the App is uninstalled, Atlassian deletes the installation's storage and the data goes with it. The exact data categories are itemised in the Privacy Policy.

6. Secrets and credentials

The App holds no API keys, tokens or credentials for customer systems, and requires none: Forge provides the App's access to Confluence through the platform, per installation, without the App ever seeing a credential. The publisher's own development and deployment credentials are personal to the publisher, are never embedded in the App, and are rotated when they expire.

7. Software supply chain and change control

The scanning engine that reads and checks links is written by the publisher and carries no third-party runtime dependencies. The remaining code depends on Atlassian's Forge packages and React.
The App is developed in a version-controlled repository with an automated test suite that runs on every change. Behaviour that matters for security — the authorization gates on every space-scoped resolver (view access, plus space-administer for every write), the absence of any external permission in the manifest, the read-only scope set — is pinned by tests, and the production deploy script runs the full suite first and stops on any failure, so a regression fails the deploy rather than shipping.
Every release is deployed through Atlassian's Forge deployment pipeline. A change to scopes or to egress is a manifest change, which Atlassian surfaces to administrators for consent. Such a change is therefore both visible and deliberate, never silent. A change that adds egress (a host outside Atlassian, or a remote) would also end the App's Runs on Atlassian eligibility.

8. Logging and monitoring

The App's code makes no logging calls: it writes no page content, titles or user data to logs. Scan progress and failures are kept in its own Forge storage and shown in the App; the only other records are Forge's own platform records of invocations and errors, which stay within Atlassian. The App performs no analytics, no end-user tracking, and sends no telemetry to the publisher or to any third party.

9. Reporting a vulnerability

If you believe you have found a security issue in the App, please write to support@basis-s.co.il with the subject line Security report: Link Health. Include the steps to reproduce, the Confluence Cloud site type you tested against, and any relevant identifiers. We acknowledge every report, treat a confirmed issue as our first priority, and will tell you what we found and what we changed. Please do not test against sites you do not own, and please give us the opportunity to fix an issue before disclosing it publicly.

10. Incident response

Because the App keeps no customer data outside Atlassian and holds no credentials that could reach a customer site, the realistic incident surface is a defect in the App's own code. If such a defect is confirmed, we fix it, deploy the fix through Forge so that every installation receives it, and, where the issue could have affected a customer's data, notify affected administrators through the contact details Atlassian holds for the installation.

11. What you can verify yourself

The scopes the App requests are shown to the administrator at install time and remain visible in the Confluence app management screen.
The absence of external egress is reflected in the App's Runs on Atlassian status on the Marketplace listing.
The App's Privacy Policy, Data Processing Addendum and Terms are published at stable URLs on this host, and the versions here are the versions that ship.

12. Changes to this policy

If this policy changes, the "Last updated" date above will change with it. Anything that would let the App reach something new (a host outside Atlassian, or an Atlassian scope it does not hold today) is a change to the App's manifest, which Atlassian shows to administrators as a permission change requiring consent. New egress would also end the App's Runs on Atlassian status. A new kind of data kept in the App's own Forge storage is different: the storage permission the App already holds covers everything it keeps there, so such a change does not show as a permission change. What the App keeps there is summarised in §5 above and itemised in the Privacy Policy.

13. Contact

Basis Ventures — Basis Gova Binyan Veyazamut Ltd., a company registered in Israel.
support@basis-s.co.il