Support
How to reach us and what to send.
Evidence. Unless tagged, statements on this page are covered by automated tests, not confirmed on a live site. Exceptions: confirmed on a test site in testing
Contact
Write to [email protected]. Support hours: Sunday to Thursday, 09:00 to 17:00 Israel time (Asia/Jerusalem). First-response targets are in the Support Policy. The app is pre-release, so there is no support queue yet.
What to send
- The site name, app version, issue key, attachment id, status and error code shown in the issue panel or audit log.
- Never send file contents or real secrets. If a secret was missed, describe the shape of the pattern, not the value.
Security reports
Write to [email protected]. Do not include real customer data. See the vulnerability disclosure policy. No bug bounty exists.
FAQ
Does my data leave Atlassian? No. The app declares no external connections and processes everything inside the Forge runtime.
Can I get an original back? No. After a verified swap the original is deleted permanently. Use dry-run first. confirmed on a test site
Is dry-run harmless? In dry-run the app downloads and scans files and writes audit rows. It changes and deletes nothing. Dry-run is the control that stops all changes.
What does the audit log contain? Time, issue key, attachment id, file name (or its hash), file type, status, count of redactions, rule ids and error code. Never the secret values.
Why does the comment say "(edited)"? A customer's portal upload lives in a public comment. The app edits it to point at the clean file. Agents see the label "(edited)". The portal view shows no label. confirmed on a test site
Why are cookie values hidden, even for theme? By default every cookie value is redacted, because any cookie can carry identity. You can keep chosen names in Settings.
Can two labels be the same for different values? Rarely. Labels use 16 bits. Equal values always get equal labels within your site.
Does it work in all projects? Attachment processing is not limited by project type. The app user needs the project permissions in each project. The issue panel is configured for service projects.
What if my license is inactive? The app processes nothing and leaves files untouched. This was seen on a test install. confirmed on a test site The banner and the trial state are covered by automated tests only, and license behaviour in a production install is still in testing. The Leak audit still works.
Does it catch everything? No. Detection is pattern-based, and free text inside HTML response bodies is not caught. See Limits.
Are existing attachments cleaned when I turn dry-run off? No. Use "Sanitize flagged files now" for the files dry-run flagged. See Settings. confirmed on a test site
Troubleshooting
Look at the issue panel first, then the audit log (status and error code).
| Status shown | Meaning | What to do |
|---|---|---|
| Verified clean | No secret found. File left as is. | Nothing |
| Sanitized: N secrets redacted | Replaced by sanitized_<name>. Original deleted. | Check the copy if you need to |
| Would sanitize: N found (dry-run) | Dry-run found secrets. Nothing changed. | Review. Turn dry-run off when ready. |
| Skipped: too large | Over the size limit | Review by hand, or raise the limit (max 100 MB) |
| Skipped: file type not enabled | Extension not in Settings | Add it, if wanted |
| Skipped: binary file | Not text | Review by hand |
| Skipped: no longer exists | Attachment deleted before the app got to it | Nothing |
| Failed: needs attention (original kept) | The swap failed before the delete. A sanitized copy may exist. | Read the hint, fix the cause, upload again |
| Failed: needs attention (not verified) | The file could not be processed | Read the hint. The file may still hold secrets. |
Error codes ending in _FORBIDDEN mean the app user lacks a project permission. The panel names the likely one: Create attachments (upload), Delete all attachments (delete), Edit all comments (comment edit), Browse projects (download). This hint is design intent. A missing permission has not been reproduced on a test site. in testing
Nothing happens to new uploads. Check the banner for dry-run or "not licensed". Files in closed issues are not processed. Check that the extension is enabled and the file is under the size limit.
A secret was missed. Write to support with the pattern shape, not the real value.
A harmless value was redacted. Add it to the allowlist, or adjust email, entropy or cookie settings.
The inline preview shows a text note instead of the file. The app could not map the file reference. Open the sanitized_ attachment in the attachment list.
Duplicate sanitized_ files. A retried swap can leave one. Delete the extra copy by hand.
Settings will not save. Read the error next to the field. Sizes and retention have ranges.
Uninstall and data
- While installed, the app keeps audit rows in your site's Forge SQL database and settings, a random secret and progress records in Forge key-value storage. These belong to your installation. The vendor has no copy.
- After uninstall,
sanitized_attachments, edited comments and descriptions, and labels inside sanitized files stay. The app does not restore deleted originals. - Export the audit log to CSV before uninstalling. Stored app data is handled by the Forge platform on uninstall; see Atlassian's Forge documentation for the exact rules.
- The app has no "delete all audit rows now" button. To erase rows sooner, set retention to 1 month, or uninstall.