## [Are Confluence & Jira Plugins Safe? Marketplace App Security Guide](/blog/faq-using-plugins-security.md)

April 21, 2026 ·

<!-- -->

11 min read

[NGPilot](https://ngpilot.com)

Who should read this

* **Cloud admins** evaluating Marketplace apps before install
* **Security/compliance teams** running vendor risk reviews for Atlassian
* **Procurement** needing a plugin security checklist for SOC 2 / ISO 27001

What you'll learn

1. The **Forge vs Connect** security model difference (where your data lives)
2. How to read app **scopes** and spot overprivileged apps
3. What **Cloud Fortified** actually verifies
4. A copy-paste **plugin security checklist** for vendor reviews

**Tags:**

* [faq](/blog/tags/faq.md)
* [security](/blog/tags/security.md)
* [confluence](/blog/tags/confluence.md)
* [jira](/blog/tags/jira.md)
* [best-practices](/blog/tags/best-practices.md)

[**Read more**](/blog/faq-using-plugins-security.md)