How Capable apps are built

The single most useful fact for a security review is that these are Forge apps. Forge is Atlassian's own app platform, and it constrains what an app can do in ways that are enforced by Atlassian rather than promised by us.

That constraint is the foundation everything else sits on.

#What that means

Content stays in your Confluence site. Capable apps store content as attachments and custom content inside your own tenant, under your own permissions.
Permissions are Confluence's. There is no second permission model to configure or get wrong. If you can see a page, you can see what is on it.
Every outbound domain is declared in the app manifest, and the declaration is enforced by the Forge platform. An app cannot quietly connect somewhere undeclared.
Administrators approve scope changes. An app version that asks for a new permission cannot install itself silently.

#What varies by product

Some capabilities send content outside your tenant to do their job, and some do not. Diagram rendering is the clearest example, and it can be moved inside your own network entirely. The per-product spaces carry the precise answers.

Ask us the awkward questions. If a security review needs an answer this space does not give, the product's own security section usually has it, and if it does not, ask.

#A few things worth knowing

A Forge app is not the same as a Connect app. If a reviewer's questionnaire assumes Connect, several questions will not apply.
Where a product processes content outside your tenant, its own documentation says so plainly rather than leaving it to be discovered.
This page is an orientation, not a substitute for the per-product security documentation.

Reporting a security issue

How to report a suspected vulnerability, and what we do with it.

Where our services run

Which parts of Capable run where, and how to remove the parts that leave your te

Security and privacy

The rest of this section.

The platform answers most of it.