Security policy
RuleWatch is maintained by Matthew Teets, operating under the Little Engine Software brand. Matthew personally handles security reports and incident response.
Hosting and access
RuleWatch runs on Atlassian Forge, using installation-scoped Forge storage and Jira. It has no external application backend or external app egress. Atlassian manages hosting and encryption at rest. Support correspondence uses the separate Little Engine Software support route.
Monitor management requires Jira administrator permission, checked by the backend. Each monitor uses its own heartbeat Bearer credential. RuleWatch stores a hash of that credential and supports rotation and retirement. Plaintext heartbeat credentials and raw Jira error response bodies are not intentionally logged.
Data handling
Project and user lookups are transient. An optional selected assignee account ID is stored for monitor assignment, with privacy reporting and account-reference erasure handling. Jira alerts and comments follow the customer's Jira controls. The privacy notice explains data handling and removal.
Security-focused automated tests, code review and dependency vulnerability checks have been used in development and release validation.
Report a security concern
Report suspected vulnerabilities or incidents to [email protected]. General support is available through the support contact. Include affected behavior, version and relevant times. Do not send credentials or unnecessary personal data. Contact Matthew before testing a live installation.
Incident response
Matthew follows an adopted incident-response process to assess reports, contain impact, handle necessary evidence securely, investigate, remediate, verify fixes and document lessons. He will notify Atlassian and affected customers when appropriate and in accordance with applicable requirements.