Security Architecture & Marketplace Bugfix Policy

Vendor: AppsRaha Cloud Solutions (appsraha.com)

1. Authentication & Tenant Isolation

All communication between Atlassian Forge and https://engine.appsraha.com is authenticated via cryptographic Forge Invocation Tokens (FIT / RS256 JWT) verified against Atlassian's official JWKS endpoint. Database connections strictly enforce UseConnectionPooling=false and InitiateOAuth=OFF to guarantee zero cross-tenant token reuse.

2. Encryption in Transit & HSTS

All endpoints enforce TLS 1.2 / TLS 1.3 with strong AEAD cipher suites and strict HTTP Strict Transport Security (Strict-Transport-Security: max-age=31536000; includeSubDomains; preload).

3. Atlassian Marketplace Security Bugfix SLOs

• Critical Severity (CVSS 9.0–10.0): Remediated within 2 weeks.
• High Severity (CVSS 7.0–8.9): Remediated within 4 weeks.
• Medium Severity (CVSS 4.0–6.9): Remediated within 8 weeks.
• Low Severity (CVSS 0.1–3.9): Remediated within 12 weeks.

4. Reporting a Vulnerability

To report a security issue, please email security@appsraha.com or support@appsraha.com.