Markso Editor
Security Policy

Secure by Architecture

Markso is built on Atlassian Forge — a sandboxed, serverless runtime hosted and maintained by Atlassian. Forge functions run in isolated execution environments with no persistent server infrastructure that could be compromised. There is no server for attackers to target, no persistent process to patch, and no infrastructure for Agilva to manage.

Content Security Policy

Markso enforces strict CSP compliance throughout:

• No inline styles injected via JavaScript — all styling via CSS classes
• No external script or stylesheet loading at runtime
• All libraries bundled at build time via npm — no CDN dependencies
• DOMPurify used to sanitise all Markdown-rendered HTML before injection into the DOM

XHTML Validation

The Source Editor validates all XML against a strict parser before allowing a save. Invalid XHTML cannot be written to a Confluence page under any circumstances. The Save button is programmatically disabled until validation passes. This prevents both accidental corruption and any attempt to inject malformed markup.

Input Sanitisation

All user-generated Markdown is sanitised with DOMPurify before rendering. The following are explicitly allowed:

• Standard HTML elements (headings, paragraphs, lists, tables, code)
• <details> and <summary> for collapsible sections
• align attribute for text alignment
• class attribute for task list styling

The following are explicitly blocked regardless of input:

• <script> tags of any kind
• on* event attributes (onclick, onload, etc.)
• External resource references (src pointing to external URLs in iframes)
• Data exfiltration attributes

Dependency Management

All dependencies are pinned to specific versions in package.json. No runtime dependency fetching occurs. npm audit is run before every deployment. Primary runtime dependencies are CodeMirror 6, marked.js, DOMPurify, and Mermaid — all well-maintained, widely audited open source libraries.

Forge Platform Security

Markso inherits Atlassian Forge's platform-level security, which includes:

• Function-level sandboxing with no shared state between invocations
• Automatic HTTPS for all API calls — no unencrypted communication
• Atlassian-managed authentication with no custom auth implementation
• No persistent server infrastructure to patch or maintain

Vulnerability Disclosure

If you discover a security vulnerability in Markso Editor, please report it responsibly by contacting Agilva Solutions via the Get in Touch form. Please include a description of the issue and steps to reproduce it. We will acknowledge receipt within one business day and provide a resolution timeline.

Contact

For security-related questions or vulnerability reports, contact Agilva Solutions via the Get in Touch form.