Skip to main content

How to Evaluate an Atlassian Marketplace App: A Security Checklist

· 10 min read
NGPilot
Quick Answer

Before installing any Atlassian Marketplace app, run it through this checklist: verify Cloud Fortified status, confirm whether it is Forge or Connect, review the OAuth scopes it requests, read its privacy and data handling disclosure, and check its install count, ratings, and release cadence. Apps that pass all five are low-risk; apps that fail any of them deserve a closer look before they touch your production site.

What you'll learn
  1. The trust signals Atlassian exposes on every Marketplace listing
  2. How to read an app's permission scopes before installing
  3. Why Forge and Connect carry different security burdens
  4. The questions to ask a vendor during a security review
  5. A copy-paste checklist you can run on any app in under five minutes

The Atlassian Marketplace has thousands of apps, and installing the wrong one can expose your Jira and Confluence data to a vendor you have never vetted. The good news is that Atlassian surfaces most of what you need to make a safe decision directly on each listing — if you know where to look. This guide is a practical checklist for evaluating any Marketplace app before it lands on your site, written for the admins who get asked "is this app okay to install?" and need to answer with confidence.

The five trust signals on every Marketplace listing​

Atlassian exposes a set of badges and disclosures on each app's Marketplace page. They are not decorative — each one tells you something specific about the app's security and reliability posture. Here is what each means and how much weight to give it.

1. Cloud Fortified​

Cloud Fortified is Atlassian's trust tier for apps that go beyond baseline requirements. To earn it, an app must:

  • Complete the Privacy and Security tab on its Marketplace listing — a structured disclosure of its data handling, storage, and compliance practices, researched and designed around what enterprise buyers actually ask.
  • Participate in the Marketplace Security Bug Bounty Program (hosted on Bugcrowd), meaning security researchers can test the app for vulnerabilities and the vendor pays rewards for valid findings. Apps in the program display a green checkmark.
  • Meet reliability requirements around uptime and incident response.
  • Meet support requirements with defined response times.

As of 2026, new Cloud Fortified designations require the app to be built on Forge. This is the single strongest trust signal on the Marketplace — if an app has it, a substantial part of your security review is already done.

2. Built on Forge (vs Connect)​

The framework an app uses determines where its code runs and where your data goes. This matters more than most admins realize.

  • Forge apps run on Atlassian-managed infrastructure. The compute, storage, and UI all live inside Atlassian's platform. Permissions are declared in a manifest and enforced by the platform — an app literally cannot access data outside the scopes it requested and Atlassian approved. No vendor-controlled server processes your data.
  • Connect apps run on the vendor's own servers. The vendor is responsible for encryption, patching, access control, and breach response. Atlassian reviews Connect apps at submission, but ongoing security depends entirely on the vendor's maturity — which varies wildly across the ecosystem.

For a deeper treatment of the architectural difference and the 2026 Connect penalty, see our Forge vs Connect guide. The short version for security review: Forge shifts the security burden to Atlassian; Connect leaves it with the vendor. If you are evaluating an app that handles sensitive data and it is Connect-based, the vendor review is on you.

3. OAuth scopes and permissions​

At install time, every app presents the permissions it is requesting. This is not a formality — it is the most direct signal of what the app can actually do with your data. Look for:

  • Scope granularity. A diagraming app requesting only read:confluence-content and write:confluence-content is scoped appropriately. The same app requesting read:jira-user or admin-level scopes should prompt a question.
  • Broad vs narrow. Phrases like "access all data" or "full access" are red flags. Prefer apps that request the minimum scopes needed for their function — this is least-privilege access, and Atlassian enforces it for Forge apps.
  • Egress declarations. Forge apps must declare any external endpoints they call. If an app declares egress to a third-party analytics or AI service, that tells you where your data could go.

If the scopes an app requests do not match what the app claims to do, stop and ask the vendor why.

4. Privacy policy and data handling disclosure​

The Privacy and Security tab on the Marketplace listing is where the vendor declares how the app handles your data: what it collects, where it is stored, how long it is retained, whether it is shared with third parties, and what happens on uninstall. Read it. Specifically check:

  • Data storage location. Is data stored on Atlassian (Forge), on the vendor's infrastructure (Connect), or transmitted to a third party? For regulated data, the answer determines whether the app is even eligible.
  • Data retention. Does the vendor delete your data on uninstall, or retain it? Retention after uninstall is a common compliance problem.
  • Third-party sharing. Does the app send data to analytics, advertising, or AI subprocessors? These should be named.
  • Compliance claims. SOC 2, GDPR, and ISO 27001 statements belong here if the vendor has them.

An app with a missing or vague privacy disclosure is not necessarily malicious, but it is a signal that the vendor has not invested in the trust surface that security-conscious buyers expect.

5. Install count, ratings, and release cadence​

These are the social and operational signals:

  • Install count and active users indicate real-world adoption. An app with tens of thousands of installs has been stress-tested across environments; an app with single-digit installs is unproven.
  • Star ratings and review count reflect sustained quality, not just first impressions. Read the negative reviews — they often reveal the failure modes that matter (data loss, broken exports, support responsiveness).
  • Release cadence shows whether the vendor actively maintains the app. A app last updated two years ago is a maintenance risk; an app with regular releases is being invested in. Check the versions tab on the listing.

A copy-paste checklist​

Run this on any app before installing it on a production site. It takes about five minutes once you know where to look.

  • Cloud Fortified? If yes, much of the review is done. If no, proceed with the rest.
  • Forge or Connect? Prefer Forge for sensitive data. If Connect, plan a vendor review.
  • Scopes match the function? Reject apps requesting permissions broader than their purpose.
  • Privacy and Security tab complete? Check storage location, retention, and third-party sharing.
  • Bug Bounty participant? Look for the green checkmark — means the app is externally tested.
  • Install count and ratings healthy? Tens of thousands of installs and a 4+ rating is a strong signal.
  • Recently updated? Check the versions tab for a healthy release cadence.
  • Vendor responsive? For critical apps, send a pre-sales question and see how long they take.
  • Data residency matches your requirements? For regulated industries, confirm where data is stored.
  • Clean uninstall? Confirm the vendor's data retention policy on uninstall.

Questions to ask a vendor during a security review​

For apps that will touch compliance-relevant data, a short vendor questionnaire is worth the effort. These questions cut through marketing copy:

  1. Where exactly is our data stored, and who controls the infrastructure it sits on?
  2. What subprocessors do you use, and for what purpose?
  3. What is your incident response process and SLA?
  4. Do you retain our data after uninstall, and for how long?
  5. What scopes does the app request, and can you justify each one?
  6. Are you Cloud Fortified, and if not, what is your timeline?
  7. What is your vulnerability management process, and do you participate in the Bug Bounty Program?
  8. How do you handle data residency for customers with regional requirements?

A vendor that answers these clearly and quickly is one you can trust operationally. A vendor that hedges or takes weeks to respond is telling you something important about how they will behave when something goes wrong.

How NGPILOT apps measure against this checklist​

Every NGPILOT app is built exclusively on Forge, which means the answer to the hardest security questions is built into the architecture:

  • Data never leaves the Atlassian platform. No NGPILOT-controlled servers process your data — compute and storage are Atlassian-managed.
  • Permissions are scoped and platform-enforced. Each app requests only the scopes it needs, declared in its manifest and enforced by Atlassian.
  • No external data egress to analytics, advertising, or AI subprocessors.
  • Clean by design — there is no vendor infrastructure to audit, patch, or worry about going offline independently of Atlassian.

You can read the full security and data handling details on our Trust Center, or browse the app catalog to see which apps fit the problems your team is solving. We also publish scenario-based solutions if you would rather start from the problem you are trying to solve than from an app name.

Frequently Asked Questions​

What is the most important thing to check before installing a Marketplace app?​

If you check only one thing, check whether the app is Cloud Fortified — it bundles together privacy disclosure, bug bounty participation, and reliability/support requirements. If the app is not Cloud Fortified, the framework (Forge vs Connect) and the requested scopes are the next most important signals.

Are paid apps safer than free apps?​

Not necessarily. Safety is determined by the framework, scopes, and vendor practices — not the price tier. A free Forge app with narrow scopes can be safer than a paid Connect app with broad data access. Evaluate free apps with the same checklist.

What is the Marketplace Security Bug Bounty Program?​

It is a program hosted on Bugcrowd where security researchers test Marketplace apps for vulnerabilities and vendors pay rewards for valid findings. Apps that participate display a green checkmark on their listing. It is a strong signal that the app is being externally stress-tested for security flaws.

Can I install an app on a trial basis to evaluate it?​

Yes — every Marketplace app offers a free trial, and Atlassian provides a free tier (up to 10 users) for most apps. A trial lets you observe the app's behavior, scopes, and data handling in a non-production site before committing. Use the trial to run the checklist above against the live app.

Where can I read Atlassian's official guidance on app security?​

Atlassian's Marketplace trust portal covers the trust programs and badges, and the Cloud Fortified security requirements document the exact criteria an app must meet.

NGPILOT apps are built exclusively on Forge — no customer data leaves the Atlassian platform. Browse the app catalog or read our Trust Center for the full security and data handling details.

Related guides