Space Access Audit for Confluence · Last updated 11 September 2026
Summary: a read-only Forge app with no external infrastructure. It is eligible for Atlassian's Runs on Atlassian programme, which requires that the app runs entirely on Atlassian's platform, stores data only in Forge storage, transmits nothing to the vendor, and exposes no public endpoint.
Architecture
Platform: Atlassian Forge, deployed and executed inside Atlassian's infrastructure. There is no vendor-operated server, container, database or proxy.
Egress: none. The app calls only the Confluence Cloud REST API of the site it is installed on, through Forge's own HTTP client. It has no external API keys and no third-party endpoints configured.
Public attack surface: none. The app defines no web trigger, no webhook and no inbound HTTP endpoint. Nothing is reachable from the internet.
Authentication: the app authenticates to Confluence as the installed app (app identity), never with stored user credentials, and it never asks for a user's password or API token.
Permissions and least privilege
Scope
Purpose
read:space:confluence
List spaces.
read:space.permission:confluence
Read space permission assignments.
read:group:confluence
Resolve group names.
read:confluence-user
Resolve display names and guest / unlicensed flags.
write:confluence-file
Upload the generated CSV report as an attachment, only to the page an admin designates.
storage:app
Store the export target page id and the daily-scan fingerprint.
No scope grants the ability to modify permissions, users, groups, spaces or content. Each scope was validated against Atlassian's published per-endpoint scope list, and unused scopes were removed rather than requested "just in case". The write scope is the narrowest one that covers the attachment endpoint; it is not used for any other purpose.
Data handling
Permission data is processed in memory in the browser session and in short-lived Forge function invocations.
Only two non-personal configuration values are persisted (export page id, permission fingerprint).
Reports are written only to a page inside your own Confluence, on your instruction.
Diagnostic logging records identifiers, HTTP status codes and error names only — never display names, email addresses or report content.
Automated gates on every change: unit tests for all audit rules and summaries; a bundler check that fails on invalid imports; and lint gates that fail on undefined identifiers and on use-before-declaration defects. These gates exist because each one caught a real defect that a successful deployment would otherwise have shipped.
Rules are deterministic and testable. Every finding is produced by an explicit rule with a documented threshold, covered by tests, so severity decisions can be reviewed rather than trusted.
Least privilege by construction. New scopes are added only when an endpoint requires them and are removed when they prove unnecessary.
Honest degradation. When data cannot be read (for example anonymous access, which the API does not expose) the app says so instead of reporting a clean result; when a check cannot be completed reliably, it is disabled and the reason is displayed.
Vulnerability reporting
Please report suspected vulnerabilities to support@boundlessstream.com. Include the affected version, a description and reproduction steps if possible. We will acknowledge your report, keep you informed while we investigate, and credit reporters who wish to be credited. Please do not test against sites you do not own or administrate.
Incident response
If a security issue affecting customers is confirmed, we will notify affected customers and Atlassian, and publish a fixed version to the Marketplace as soon as it is available. Because the app has no external infrastructure, the scope of any incident is inherently limited to Forge-resident code and configuration.