Gherkit security policy
Last updated: 21 October 2026
This page says how to report a security problem in Gherkit, how quickly we respond and fix it, and how we tell you if a security incident affects your data. Gherkit is made by Roshan Jahangir, trading as Gherkit, in the United Kingdom.
How Gherkit keeps your data inside Atlassian
- Gherkit runs entirely on Atlassian Forge. It has no servers of its own, and it makes no calls outside Atlassian.
- Customer data stays inside Atlassian:
- scenarios and test results are stored as properties on your own Jira issues;
- app settings, step suggestions and earlier versions of scenarios are stored in Atlassian-hosted Forge storage for your site.
- Gherkit only uses the permissions shown when you install it, and it checks each person's Jira permissions before it lets them edit.
- We don't receive or store your Jira content. The optional CI helper script runs in your own pipeline, with your own API token, and talks only to your Jira site.
More detail is in the privacy policy.
How to report a security problem
Email [email protected] with SECURITY in the subject line. Please include:
- what you found and where (the page, feature or address);
- the steps to reproduce it;
- what an attacker could do with it.
Please don't send real customer data, passwords or API tokens, and please give us the chance to fix the problem before you make it public. Atlassian may also pass reports to us through its Marketplace security process; we handle those in the same way.
When we acknowledge your report
We acknowledge every security report within 2 UK business days (Monday to Friday, excluding UK bank holidays). We then confirm whether it is a vulnerability, rate its severity, and keep you updated until it's fixed.
How quickly we fix vulnerabilities
We rate each confirmed vulnerability with CVSS, in the same way as Atlassian's Security Bug Fix Policy, and fix it within these times:
| Severity | CVSS score | Fixed within |
|---|---|---|
| Critical | 9.0 or higher | 10 days |
| High | 7.0 to 8.9 | 4 weeks |
| Medium | 4.0 to 6.9 | 12 weeks |
| Low | below 4.0 | 25 weeks |
These match Atlassian's deadlines for cloud apps. We count from the day we receive the report.
Because Gherkit runs on Forge, a fix reaches every site as soon as we deploy it. The exception is a fix that needs new permissions, which a site admin has to approve. Fixed vulnerabilities are listed in the release notes.
How we tell you about a security incident
A security incident means someone has, or may have, accessed, changed or deleted customer data without permission, or Gherkit itself has been compromised. If we confirm one that affects your site:
- we report it to Atlassian within 24 hours;
- we email your site's contacts within 72 hours of confirming it. The email says what happened, which data was affected, what we have done about it and anything you need to do;
- we keep you updated until it's resolved, and then tell you what we've changed to stop it happening again.
Contact
[email protected], with "SECURITY" in the subject line.