Secret Scrubber: Vulnerability disclosure policy
How to report a vulnerability, and what to expect.
Vendor: Noam Apelfeld. Report to: [email protected]. Effective: 13 November 2026.
How to report
- Email [email protected] with a description, affected version and steps to reproduce. Do not include real customer data.
- Acknowledgement target: the first-response targets in the Support Policy.
Our commitments
- We investigate every report and keep you informed.
- We aim to fix Critical issues within 10 days, High within 28 days, Medium within 84 days and Low within 175 days, matching the Atlassian Marketplace Security Bug Fix Policy summarized at https://developer.atlassian.com/platform/marketplace/marketplace-security-enforcement-policy/ .
- We do not take legal action against good-faith research that stays within this policy.
Please
- Test only against your own Atlassian site and your own data.
- Do not access other users' data, degrade service, or disclose before we have fixed the issue or agreed a date.
Out of scope
- Findings in Atlassian products or the Forge platform: report them to Atlassian.
- Detection misses (a secret shape the sanitizer does not recognize) are bugs, not vulnerabilities: report them as support requests.