...
BrizoIT is a team of Atlassian enthusiasts and develop Atlassian apps. Our goal is to create apps that resolve real life business problems. We strive to provide exceptional customer support.
The following findings are specifically excluded:
Access to exported calendar, including a private calendar (this is not a bug since the app was intended to share calendars with the public)
Testing privileges and REST services under admin accounts. Admins have rights to view, edit, and delete any data within their host Jira instance.
Important! Theoretical assumptions and predictions will be ignored. We will only consider step-by-step scenarios that lead to concrete findings. Videos and screenshots are welcome.
Note: BrizoIT uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, BrizoIT will defer to the CVSS score to determine the priority.
Worth noting: Company Calendar for Jira is designed to help people visualize any dates from Jira issues. It's a calendar-based organizer. While you may submit findings, it must have a clear threat or business impact for users. Otherwise, it is likely to be marked as won't fix or informational.
In addition, please note that our applications cache some Jira entities for 15-minutes interval. For instance, you, as admin, have removed an access to Jira from a user. The user will be able to interact with the application for up to 15 minutes, assuming there is a JWT token that was generated while the user was still granted an access to Jira.
Get Started (tl;dr version)
...
To view a list of exclusions unique to this program, please go List of Exclusions Unique to this Program https://brizoit.atlassian.net/wiki/spaces/CCJDOCS/pages/1478393859
Note: BrizoIT uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, BrizoIT will defer to the CVSS score to determine the priority.
Worth noting, Company Calendar Planner for Jira is designed to help people visualize any dates from Jira issues. It's a calendar-based organizer. While you may submit findings, it must have a clear threat or business impact for users; otherwise, it is likely to be marked as won't fix or informational.
...