Verified status
Three levels of evidence, and what is still being tested.
Nothing here is a certification. No independent audit, penetration test or bug bounty exists yet.
Checks ran on a development cloud site for Jira Service Management. The exact build was not recorded.
Confirmed on a test site
- Portal upload: sanitized copy uploaded, inline preview rendered, original deleted, audit row written
- Internal comment swapped and stayed internal
- Direct attach, uploaded through the REST API (the agent-view attach button was not used)
- File inline in the description
- Inline PNG left alone: no copy, no audit row
- Real Chrome HAR from a login page: password field and session cookies redacted. Limit: free text in an HTML response body was not redacted
- A 27 MB file skipped as too large and left untouched
- A file containing a NUL byte skipped and left untouched
- Sanitize flagged files now: 12 files, then 50 files with cancel and resume
- Sanitize flagged files now refuses to start while dry-run is on
- Leak audit
- Permission check runs and reported nothing missing on the test project
- Inactive license: five uploads started no processing and left files untouched
- Active license: files processed normally
- Install with three permissions (scopes)
Covered by automated tests
- Detection and redaction rules, on synthetic test fixtures
- HAR, JSON and text parsing
- Original deleted only after a verified swap; a failure before the delete leaves it untouched
- Dry-run on by default
- No external fetch backends declared; no external URLs or telemetry in the source
- Value-free logs and audit rows
- Several references to one file
- A missing permission stopping the app
- The trial license, the inactive banner and the license log states
- Retry-failed, and the pace of about 30 files per minute without rate limiting
- Totals after a hard kill
- CSV export
- The daily retention purge
- Issue panel visibility by project type
Still in testing
- The Permission check listing a missing permission (not reproduced)
- License behaviour in a production install
- More real browser exports from other sites
Last updated:
No maximum is promised for the time the original stays visible. Small files took 5.6 to 6.7 seconds on a development site. Large files and the time until search can find the original were not measured. See Security.