Security Policy — MR Dashboard for GitLab

Reporting a Vulnerability

If you believe you've found a security vulnerability in MR Dashboard for GitLab, please report it to sklabs.security@gmail.com with steps to reproduce the issue. We acknowledge reports within 3 business days and prioritize confirmed vulnerabilities for a fix.

Scope

This policy covers MR Dashboard for GitLab, an Atlassian Forge app. It does not cover the GitLab or Jira/Atlassian platforms themselves — vulnerabilities in those should be reported to GitLab or Atlassian directly.

Access Model

The GitLab connection for a Jira project lives on its own Project settings → Apps → MR Dashboard page. That page is a native Jira projectSettingsPage module, so it inherits Jira's own project-settings permission model — Atlassian, not the app, controls who can reach it. In practice: whoever can administer a Jira project's settings can view and change that project's GitLab connection; nobody else can. The app's backend independently rejects any request to save, test, or search connections that didn't originate from that settings page, as a second layer against a compromised or misbehaving client.

Recommended Token Scope

Use a narrowly-scoped token such as a Project Access Token (or Group Access Token, for group-mode dashboards) with the Reporter role and the read_api scope, rather than a personal token tied to your own GitLab account — it isn't attached to any individual's account, so it keeps working if that person leaves, and revoking it never affects anyone's personal access. The app only ever reads (merge requests, members, notes); it never needs write access.

On a Jira Free plan, every site member effectively has administrator-level access to every team-managed project — Free has no project-role system, so anything gated only by "who can administer this project" (including this settings page) is effectively open to your whole team. Narrowing the GitLab token's own permissions matters more on Free for exactly this reason. Restricting the settings page to a smaller group of people requires a paid Jira plan (Standard or above), where project roles can be configured.

Data Handling Summary

• The app runs entirely on Atlassian Forge infrastructure — we operate no servers of our own.
• The GitLab access token is stored in Forge Secret Storage, encrypted at rest.
• Merge request statistics are cached for up to 2 minutes in Forge storage.
• The only external network calls the app makes are to the customer's own GitLab instance (the one configured in Settings).
• No data is shared with any third party.

See the Privacy Policy for the full details.

Responsible Disclosure

Please do not publicly disclose details of a vulnerability before a fix has been released. Accessing or misusing customer data while researching a vulnerability is not permitted.