Sift — Table Filters, Pivots & Charts for Confluence Sift — Table Filters, Pivots & Charts for Confluence

Sift — Table Filters, Pivots & Charts for Confluence — Security Information

This document describes the security posture of Sift — Table Filters, Pivots & Charts for Confluence, the Atlassian Marketplace app. It is intended for security reviewers at customer organisations evaluating Sift — Table Filters, Pivots & Charts for Confluence for installation.

Platform

Sift — Table Filters, Pivots & Charts for Confluence is built entirely on Atlassian Forge, Atlassian's hosted application platform. Sift — Table Filters, Pivots & Charts for Confluence operates no third-party servers and runs no code outside Atlassian's network. No End-User Data is transmitted outside Atlassian's infrastructure.

What this means in practice

Permissions

Sift — Table Filters, Pivots & Charts for Confluence requests two read-only Atlassian scopes:

Scope Reason
read:page:confluence Read the body of the current page so the app can find the table the page editor selected as a data source and the macro's saved configuration
read:attachment:confluence List the page's attachments and read the CSV/TSV/JSON file the page editor selected as a data source

That is the complete scope list. The app requests no write scopes, no administrative scopes, no user scopes, no storage scopes, no outbound network scopes, and no Confluence space-level scopes.

The app does not request external network egress. No host appears in permissions.external.fetch because the app never calls any external host.

Authentication

The app uses one authentication pattern, Forge asUser(), for every data read.

Forge asUser() (read page body and selected attachment)

When a page containing the Sift macro is rendered, the app is invoked by Forge with the signed-in viewer's identity. All reads — the page body, the attachments list, and the content of the one attachment selected as a data source — are made asUser(), so Atlassian's identity platform authorises each read against the viewer's own permissions. If the viewer cannot read the page or the attachment, the call fails and the app surfaces a "No permission" message inside the macro — the app cannot read content the viewer themselves cannot read.

There are no other authentication paths. The app does not use asApp(), does not consume customer-supplied API keys, and does not store any credentials anywhere.

Secret handling

None. Sift stores no secrets, no API keys, no OAuth tokens, no client credentials, and no encryption keys. The app has no kvs.setSecret() calls, no @forge/kvs usage of any kind, and no settings panel to enter credentials.

There is nothing to rotate, revoke, or audit on the secrets side — because there are no secrets.

Account actions

None. Sift never writes to any account, page, attachment, group, or storage. It has no write scopes (see Permissions). It cannot delete, suspend, reclaim, or modify anything — including the user's own data, the page being viewed, its attachments, or any other Confluence content. The macro's saved settings (source choice, filters, pivot, display options) are written by Confluence itself as part of the page when the page editor saves the page — exactly as for any macro — never by the app.

The app's interaction with the Atlassian platform is exhaustively:

  1. Receive an invocation when a page containing the macro is rendered (or its editor is opened)
  2. Read the page body — and, for file sources, the selected attachment — via asUser()
  3. Apply the saved filters, compute any pivot, and prepare the table/chart in memory
  4. Return the rendered result to the macro UI

There is no fifth step. There is no audit log because there is no action to audit.

Filtering, pivoting, and zero-egress guarantees

All parsing (table, CSV, TSV, JSON), filtering, pivot aggregation (Sum, Count, Count distinct, Average, Min, Max, Median), and chart-data preparation are performed by pure TypeScript functions in src/lib/ running inside the Forge sandbox. These functions:

The lib/ functions are unit-tested with Vitest. Forge I/O (page and attachment reads) is isolated in the thinnest possible resolver shell. Hard limits are enforced in memory: at most 10,000 rows rendered per macro, attached files up to 4 MB, pasted data up to 200 rows. Reader-side interactions on the published page (sort, filter, search, pagination, CSV export) run entirely in the viewer's browser on data already authorised for that viewer — nothing is sent or stored.

There is no AI, no analytics, no telemetry, no error reporting service, and no third-party SDKs of any kind embedded in this app. The Marketplace security review for this app is intentionally trivial: there is nothing to review because nothing leaves the runtime.

Vulnerability reporting

Security vulnerabilities can be reported to security@taskhooker.com. We commit to acknowledging reports within 5 business days and disclosing patches via the Marketplace "What's new" section.

Sift — Table Filters, Pivots & Charts for Confluence is a solo-developer product. We do not currently operate a paid bug bounty programme.

Compliance

Sift — Table Filters, Pivots & Charts for Confluence inherits the security and compliance posture of the underlying Atlassian Forge platform. Atlassian Forge is certified under:

Sift — Table Filters, Pivots & Charts for Confluence itself does not have independent certifications. The app code is reviewed by Atlassian as part of the Marketplace listing approval process.

Audit & change history

For your records, every code change to Sift — Table Filters, Pivots & Charts for Confluence is reflected in the What's new section of the Marketplace listing for each version. The Marketplace partner portal also exposes a full version history for compliance audits.