T-01
Atlassian Authentication & Identity Security
Evaluate application authentication mechanisms, OAuth 2.0 integrations, access tokens, JWT validation where applicable, identity handling, and potential authentication bypass vulnerabilities.
Services · Atlassian Marketplace App Security
Atlassian Marketplace Application Security Testing
Your App Extends Atlassian. Make Sure It Doesn't Extend the Attack Surface.
At Bugquell, we provide expert-led security assessments for Atlassian Marketplace applications. Our researchers uncover authorization weaknesses, insecure API integrations, privilege escalation, tenant isolation flaws, and business logic vulnerabilities that could expose sensitive Jira and Confluence data.
Overview
What Is Atlassian Marketplace Application Security Testing?
FORGE
Forge Apps
Resolvers, permission scopes and request context.
CONNECT
Connect Apps
JWT validation, install lifecycle and tenant context.
TENANT
Tenant Isolation
Keeping each customer's data separate.
Platforms covered
JiraConfluenceForgeConnectOAuth 2.0Webhooks
Tools we use
Burp Suite ProfessionalPostman
Atlassian Marketplace applications extend the functionality of platforms such as Jira and Confluence, helping organizations manage projects, automate workflows, collaborate, and integrate business-critical services.
These applications frequently interact with sensitive information, including project details, issue records, user identities, internal documentation, permissions, and organizational data. Security vulnerabilities in Marketplace applications can create risks not only for individual users but also for the organizations that install and rely on these integrations.
Atlassian Marketplace Application Security Testing is a specialized assessment designed to identify vulnerabilities in Marketplace apps, their backend services, authentication mechanisms, authorization controls, APIs, and integrations with Atlassian products.
Modern Atlassian applications may use Atlassian Forge, Atlassian Connect, REST APIs, OAuth 2.0, webhooks, and external application services. Each architecture introduces security considerations involving application permissions, identity handling, tenant isolation, and data protection.
At Bugquell, our security researchers follow a manual-first, research-driven penetration testing approach to identify security weaknesses that automated scanning tools may overlook.
We investigate how Marketplace applications enforce permissions, access Jira and Confluence resources, handle authentication, process sensitive information, and interact with Atlassian platform services. Our assessments are tailored to the application's architecture, supported Atlassian products, deployment model, and agreed testing scope.
Coverage
What We Test
T-02
Authorization & Permission Enforcement
Assess whether Marketplace applications correctly enforce user permissions, project-level restrictions, space permissions, and administrative access controls.
T-03
Broken Object Level Authorization (BOLA / IDOR)
Identify vulnerabilities that allow unauthorized access to Jira issues, Confluence content, application records, or other resources through manipulated identifiers and API parameters.
T-04
Privilege Escalation Vulnerabilities
Investigate whether users with limited permissions can execute administrative functions, modify restricted settings, or access protected resources.
T-05
Multi-Tenant Isolation Security
Evaluate whether data belonging to one Atlassian site, organization, or tenant can be accessed or modified by users from another tenant.
T-06
Atlassian Forge Application Security
Assess Forge functions, resolvers, custom UI integrations, declared permissions, backend authorization, and interactions with Atlassian APIs.
T-07
Atlassian Connect Application Security
Evaluate Connect application authentication, JWT validation, installation lifecycle handling, tenant context verification, and backend authorization controls.
T-08
Jira & Confluence REST API Security
Assess API endpoints and integrations for broken authorization, insecure request handling, excessive data exposure, and business logic vulnerabilities.
T-09
Webhook & Event Security
Evaluate webhook authentication, event validation, request integrity, replay protection where applicable, and unauthorized event processing.
T-10
Sensitive Data Storage & Exposure
Identify insecure handling of Jira project information, Confluence content, credentials, access tokens, application configuration data, and other confidential information.
T-11
Business Logic & Workflow Security
Investigate application workflows, automation rules, approval mechanisms, subscription restrictions, and other business processes for potential security weaknesses.
T-12
Security Misconfiguration & Third-Party Integrations
Review application-level security configurations, permission scopes, exposed endpoints, external service integrations, and potentially insecure application settings.
Threats
Common Atlassian Marketplace Application Vulnerabilities
01Broken Authorization Controls
Marketplace applications may fail to verify whether users have appropriate permissions to access Jira issues, Confluence pages, or application-specific functionality.
Impact · Unauthorized access to project information, confidential documentation, and restricted business operations.
02Insecure Direct Object References (IDOR)
Applications may expose resources through predictable or user-controlled identifiers without sufficient authorization checks.
Impact · Unauthorized access to other users' records, Jira issues, Confluence content, or application-managed resources.
03Privilege Escalation
Users with limited permissions may be able to perform administrative actions or access functionality intended for higher-privileged users.
Impact · Unauthorized configuration changes, modification of protected resources, and compromise of application security boundaries.
04Cross-Tenant Data Exposure
Insufficient tenant isolation may allow one Atlassian site or organization to access resources belonging to another customer.
Impact · Confidential information disclosure, unauthorized data modification, and compromise of customer data separation.
05Improper OAuth & Token Validation
Weaknesses in OAuth integrations, JWT validation, token handling, or identity verification may expose authentication and authorization mechanisms to abuse.
Impact · Unauthorized API access, identity confusion, and potential account or integration compromise.
06Excessive Application Permissions
Marketplace applications may request broader platform permissions than required for their functionality or fail to restrict how those permissions are used.
Impact · Increased exposure of Jira and Confluence data and greater impact if application functionality is compromised.
07Insecure Forge Resolver Authorization
Forge applications may fail to validate user permissions or request context before executing privileged backend operations.
Impact · Unauthorized actions performed through application functions with elevated platform access.
08Insecure Webhook Processing
Applications may process incoming events without sufficient verification of authenticity, integrity, or expected context.
Impact · Unauthorized workflow execution, manipulation of application data, and abuse of integrated services.
09Business Logic Vulnerabilities
Weaknesses in application workflows may allow users to bypass restrictions, manipulate automation processes, or perform unauthorized business operations.
Impact · Workflow manipulation, unauthorized changes, and disruption of business processes.
10Sensitive Information Disclosure
Application endpoints, logs, error responses, or storage mechanisms may expose confidential information or security-sensitive credentials.
Impact · Exposure of customer data, access tokens, application secrets, or internal system information.
Methodology
Our Atlassian Marketplace Application Security Testing Methodology
STEP 1
Scope & Application Architecture Review
We begin by understanding the Marketplace application's functionality, supported Atlassian products, deployment architecture, authentication mechanisms, permission scopes, and business requirements.
Our team identifies whether the application uses Forge, Connect, external services, or other supported integration models.
We establish the authorized testing scope, testing environments, user roles, tenant configurations, and rules of engagement before the assessment begins.
STEP 2
Reconnaissance & Attack Surface Mapping
Our security researchers explore the application's features, administrative settings, user workflows, integration points, and exposed endpoints.
Using Burp Suite Professional and Postman, where appropriate, we analyze HTTP requests, API interactions, authentication tokens, application parameters, and backend responses.
We document relevant Jira and Confluence integrations, application APIs, webhooks, and areas requiring deeper manual investigation.
STEP 3
Authentication & Authorization Testing
We manually evaluate authentication workflows, permission enforcement, identity handling, and access restrictions.
Our researchers compare application behavior and API requests across different Atlassian user roles, project permissions, space permissions, and application-specific roles.
Testing focuses on identifying IDOR, BOLA, privilege escalation, unauthorized administrative actions, and inconsistent permission enforcement.
STEP 4
Forge, Connect & API Security Testing
For Forge applications, we investigate backend resolvers, request context validation, declared permission scopes, and access to Atlassian platform APIs.
For Connect applications, we evaluate applicable JWT authentication, installation context, tenant identification, and backend authorization.
We also assess application REST APIs and relevant Jira or Confluence integrations for insecure request handling and unauthorized resource access.
Testing is adapted to the application's actual architecture and supported platform capabilities.
STEP 5
Multi-Tenant Isolation & Business Logic Testing
We evaluate whether application data and functionality remain appropriately isolated between Atlassian sites, organizations, and customer tenants.
Our researchers investigate application workflows, permission boundaries, administrative functionality, and integration behavior.
Where appropriate, we examine whether multiple security weaknesses can be chained to demonstrate greater security impact.
STEP 6
Vulnerability Validation & Impact Analysis
Potential vulnerabilities are manually validated through controlled testing within the authorized scope.
We evaluate exploitability, required permissions, affected resources, and potential impact on Jira projects, Confluence content, customer data, and application functionality.
Testing is performed with precautions to minimize disruption to customer environments and connected Atlassian services.
STEP 7
Detailed Security Reporting
We provide a comprehensive Marketplace application security assessment report documenting validated vulnerabilities, affected functionality, severity ratings, reproduction steps, technical evidence, business impact, and remediation recommendations.
STEP 8
Remediation Support & Retesting
We provide practical guidance to help application developers understand and resolve identified security weaknesses.
Where included in the engagement, we retest previously identified vulnerabilities to verify whether implemented security fixes effectively address the reported issues.
Deliverables
What You Receive
D-01
Executive Security Summary
A clear overview of the Marketplace application security assessment, major findings, potential business risks, and recommended remediation priorities.
D-02
Detailed Technical Vulnerability Report
Comprehensive documentation of validated vulnerabilities, affected application components, APIs, permission controls, and severity classifications.
D-03
Proof-of-Concept Evidence
Relevant HTTP requests and responses, screenshots, reproduction steps, and supporting evidence demonstrating identified security weaknesses.
D-04
Authorization & Tenant Isolation Findings
Detailed explanations of identified permission weaknesses, unauthorized access scenarios, privilege escalation, and cross-tenant security issues.
D-05
Risk & Business Impact Assessment
An evaluation of how identified vulnerabilities could affect customer data confidentiality, application integrity, Jira and Confluence resources, and business operations.
D-06
Actionable Remediation Recommendations
Practical recommendations to help development teams strengthen authentication, authorization, API security, and tenant isolation controls.
D-07
Retesting & Verification Results
Documentation of remediation verification where retesting is included in the agreed assessment.
Why us
Why Choose Bugquell?
W-01
Specialized Marketplace Application Security Testing
We investigate the security of Atlassian Marketplace applications, including their authentication mechanisms, authorization controls, APIs, and platform integrations.
W-02
Manual-First Security Assessments
We prioritize hands-on penetration testing to identify vulnerabilities that automated scanners may overlook, particularly those involving complex permissions and application business logic.
W-03
Expertise in Authorization & Privilege Escalation
Our researchers focus on IDOR, BOLA, broken access controls, horizontal and vertical privilege escalation, and unauthorized administrative functionality.
W-04
Forge, Connect & API Security Focus
Our assessments account for the security considerations of Forge and Connect applications, including permission scopes, identity context, backend authorization, and API integrations.
W-05
Multi-Tenant Security Assessment
We investigate whether applications properly isolate customer information and enforce authorization boundaries between different Atlassian sites and organizations.
W-06
Clear & Actionable Reporting
Our reports explain vulnerabilities, technical evidence, business impact, and remediation recommendations in a format understandable to both technical and non-technical stakeholders.
W-07
ISO/IEC 27001:2022 Certified
Bugquell operates an ISO/IEC 27001:2022-certified information security management system, demonstrating our commitment to structured information security practices.
Ready to scope your Marketplace app?
Request a Security Assessment →FAQ
Frequently Asked Questions
Q01What is Atlassian Marketplace Application Security Testing?+
It is a specialized security assessment that evaluates Marketplace applications, their authentication mechanisms, authorization controls, APIs, tenant isolation, and integrations with Atlassian products to identify vulnerabilities and assess their potential impact.
Q02Do you test both Jira and Confluence Marketplace applications?+
Yes. We assess applications that integrate with Jira, Confluence, or both platforms, depending on the application's architecture and agreed testing scope.
Q03Can Bugquell assess Atlassian Forge applications?+
Yes. Our assessment methodology covers relevant Forge application functionality, including backend resolvers, permission scopes, identity context, and interactions with Atlassian APIs.
Q04Do you test Atlassian Connect applications?+
Yes. Where applicable, we evaluate Connect authentication, JWT validation, installation context, backend APIs, and authorization controls.
Q05What are the most common security risks in Marketplace applications?+
Important risks include broken authorization, IDOR, privilege escalation, cross-tenant data exposure, insecure API integrations, excessive permissions, authentication weaknesses, and business logic vulnerabilities.
Q06Can a Marketplace application expose Jira or Confluence data?+
Yes. If an application has access to sensitive Jira or Confluence resources and does not properly enforce authorization or data protection controls, vulnerabilities may expose information beyond intended permissions.
Q07Do you test cross-tenant security vulnerabilities?+
Yes. We investigate whether users or applications associated with one Atlassian site or customer tenant can access or modify resources belonging to another tenant.
Q08Do you perform manual or automated Marketplace application security testing?+
Bugquell follows a manual-first testing approach. Tools such as Burp Suite Professional and Postman support request analysis and API testing, while our researchers manually investigate application behavior and validate vulnerabilities.
Q09Does this assessment guarantee Atlassian Marketplace approval or security compliance?+
No. Our penetration testing identifies and documents security weaknesses within the agreed scope. Marketplace approval, Atlassian security program participation, and compliance decisions are governed by Atlassian's applicable requirements and processes.
Q10How long does a Marketplace application security assessment take?+
The assessment duration depends on application complexity, supported Atlassian products, number of features, user roles, backend integrations, tenant architecture, and agreed scope.
We provide an estimated timeline after reviewing the application and assessment requirements.
Attack surface: unknown
Build Trusted Atlassian Apps. Start With Stronger Security.
Protect your Marketplace application and the organizations that depend on it with expert-led security testing from Bugquell. Identify authorization weaknesses, insecure API integrations, tenant isolation flaws, and business logic vulnerabilities before they expose sensitive customer data.