Security
SpecLens is built so that the safest option is the default one.
Architecture
- Built on Atlassian Forge. All computing happens on Atlassian infrastructure; Klob Apps runs no servers for SpecLens.
- No external requests: the app declares no external permissions, so it cannot send data outside Atlassian.
- No storage: SpecLens does not save specifications, settings outside the macro, or usage data.
- SpecLens only reads files attached to the page where the macro is. The page id comes from Atlassian's signed context, so a macro cannot be pointed at another page. On restricted pages the app cannot see, it reads as the viewing person, which may ask them once to allow access.
Permissions and why
| Permission | Reason |
|---|---|
read:attachment:confluence | List the attachments of the current page so the editor can pick the specification. |
readonly:content.attachment:confluence | Download the selected specification to render it. |
| Content: inline styles | Required by the Swagger UI, Redoc and AsyncAPI viewers. |
| Content: runtime script evaluation | Required by the AsyncAPI parser, which compiles JSON schemas at runtime. The viewer runs in Forge's isolated frame without network access to other sites. |
Reporting a vulnerability
Write to support@klobapps.com with "Security" in the subject. We acknowledge within 48 hours and fix vulnerabilities within the timeframes of the Atlassian Marketplace security requirements.