QR Hub for Confluence
Product Docs Trust Centre Privacy Policy Security Policy

QR Hub for Confluence
Security Policy

Last updated: June 2026

Overview

QR Hub for Confluence is designed with a minimal attack surface. Because the app has no backend, no external API calls, and no persistent storage, the categories of risk that affect most Atlassian apps simply do not apply here. This document describes the security architecture, the rationale for each design decision, and how to report concerns.

Architecture

QR Hub for Confluence is a pure Atlassian Forge app. Its security properties derive directly from this architecture:

  • No custom backend. There are no Agilva-owned servers, APIs, or infrastructure. The app runs entirely within Atlassian’s Forge sandboxed runtime.
  • No external network calls. The app makes no outbound HTTP requests to any service outside Atlassian’s infrastructure. QR code generation is performed client-side within the Forge UI kit frontend.
  • No persistent storage. The app does not use Forge Storage, browser storage, cookies, or any other mechanism for persisting data between sessions.
  • Read-only by design. The app requests only read scopes. It cannot write to, modify, or delete any Confluence content under any circumstances.

Permissions

QR Hub requests the smallest set of OAuth 2.0 scopes needed for the content action feature to display metadata. All scopes are read-only and scoped to the minimum resource type required:

Scope Purpose
read:page:confluence Read page title, content type, and version to display in the content action modal.
read:space:confluence Read space name to display in the content action modal.
read:confluence-user Read author display name to display in the content action modal.

Scope additions in future versions will be accompanied by an updated listing on the Marketplace and this policy document.

Data security

QR code generation

QR codes are generated client-side using a JavaScript library running inside Atlassian’s Forge UI runtime. The URL encoded into a QR code is processed locally and never transmitted over the network to any service.

Page metadata

Metadata fetched to populate the content action modal (title, space, type, author) is retrieved via the standard Confluence REST API using the user’s existing session token. This data is displayed in the UI and then discarded — it is not logged, cached, or stored.

Authentication

QR Hub uses Atlassian’s standard Forge-mediated API authentication. No credentials are stored or handled by the app itself. All token management is performed by the Forge runtime.

Atlassian Forge security

As a Forge app, QR Hub for Confluence inherits the security controls of Atlassian’s Forge platform:

  • Apps run in isolated sandboxes with no access to other tenants’ data.
  • All communication between the Forge runtime and Confluence APIs uses encrypted channels (TLS).
  • Atlassian performs security reviews of Marketplace apps as part of the listing process.
  • Atlassian holds SOC 2 Type II, ISO 27001, and other enterprise security certifications that cover the Forge infrastructure layer.

For detailed information on Atlassian Forge’s security model, refer to Atlassian’s Forge security documentation.

Vulnerability disclosure

If you discover a potential security issue in QR Hub for Confluence, please report it to Agilva Solutions before disclosing it publicly. We will acknowledge receipt within one business day and aim to resolve confirmed issues within 14 days.

We do not operate a bug bounty programme at this time, but we take all security reports seriously and will credit responsible disclosures if desired.

Contact

Security disclosures and questions can be submitted via our contact form. Please mark your message as a security enquiry so it is routed appropriately.