Security Policy

Last updated: September 8, 2026

Vacation App is committed to protecting the confidentiality, integrity, and availability of our leave-management service and its integrations. This policy describes our current security practices and the process for reporting a potential vulnerability.

Security controls

All public application and API traffic is protected with HTTPS and TLS in transit.
Passwords are stored only as bcrypt hashes; plain-text passwords are not stored. New and reset passwords require at least 12 characters including uppercase, lowercase, a number, and a symbol.
OAuth tokens for supported third-party integrations are encrypted at rest with AES-256-GCM.
Authentication uses short-lived access tokens, secure HTTP-only refresh cookies, and token rotation.
Customer workspaces are logically isolated with a separate database schema and tenant-scoped database access.
Access to administrative and leave-management functions is governed by role-based permissions.

Jira Cloud integration

The Jira Cloud integration runs on Atlassian Forge. It receives Jira product events to check leave availability and may add a comment or reassign an issue only as the user who triggered the event; Jira applies that user's project permissions. The integration communicates with Vacation App over HTTPS using an installation secret stored in Forge encrypted variables and verified by the Vacation App backend. It does not accept Forge Invocation Tokens because it does not use a Forge Remote module.

The integration uses Atlassian's personal-data reporting mechanism and removes Jira-derived integration records when an administrator disconnects or uninstalls the integration. See our Privacy Policy for the data categories and retention details.

Secure development and vulnerability management

We use automated dependency checks and TypeScript validation for the Jira Forge integration on changes and on a recurring schedule. We review security-relevant dependency alerts and remediate confirmed vulnerabilities according to severity, exploitability, and customer impact. We will communicate material security incidents to affected customers as required by applicable law and contractual obligations.

Report a vulnerability

Please report suspected vulnerabilities privately. Do not include credentials, tokens, or personal data unless it is essential to reproduce the issue.

Security contact: [email protected]

Include a description of the issue, affected URL or feature, reproduction steps, and any suggested mitigation. We aim to acknowledge reports within five business days and will keep reporters informed while we investigate.