## [How to Evaluate an Atlassian Marketplace App: A Security Checklist](/blog/how-to-evaluate-atlassian-marketplace-app.md)

August 2, 2026 ·

<!-- -->

10 min read

[NGPilot](https://ngpilot.com)

Quick Answer

Before installing any Atlassian Marketplace app, run it through this checklist: verify **Cloud Fortified** status, confirm whether it is **Forge or Connect**, review the **OAuth scopes** it requests, read its **privacy and data handling disclosure**, and check its **install count, ratings, and release cadence**. Apps that pass all five are low-risk; apps that fail any of them deserve a closer look before they touch your production site.

What you'll learn

1. The trust signals Atlassian exposes on every Marketplace listing
2. How to read an app's permission scopes before installing
3. Why Forge and Connect carry different security burdens
4. The questions to ask a vendor during a security review
5. A copy-paste checklist you can run on any app in under five minutes

The Atlassian Marketplace has thousands of apps, and installing the wrong one can expose your Jira and Confluence data to a vendor you have never vetted. The good news is that Atlassian surfaces most of what you need to make a safe decision directly on each listing — if you know where to look. This guide is a practical checklist for evaluating any Marketplace app before it lands on your site, written for the admins who get asked "is this app okay to install?" and need to answer with confidence.

**Tags:**

* [atlassian](/blog/tags/atlassian.md)
* [marketplace](/blog/tags/marketplace.md)
* [security](/blog/tags/security.md)
* [admin](/blog/tags/admin.md)
* [explained](/blog/tags/explained.md)

[**Read more**](/blog/how-to-evaluate-atlassian-marketplace-app.md)