MathWrap for Confluence — Security

Reporting a vulnerability

Email [email protected]. Please include:

• a description of the issue and its impact,
• steps to reproduce, or a proof of concept,
• the Confluence site you tested on (use your own site or a test site only).

We will acknowledge your report within 3 business days, keep you informed while we fix it, and credit you when the fix ships if you would like. Please give us a reasonable time to fix the issue before disclosing it publicly, and do not access or change other people's data while testing.

Security reports go to a separate address from general support so they are not lost in routine mail.

How the app is built

• Runs on Atlassian. The app is a Forge app hosted entirely by Atlassian. It makes no requests to outside servers (no egress) and uses no third-party services.
• Least privilege. It requests only: read and write pages (to convert formulas), read spaces (to confirm the caller is a space administrator before changing a space setting), app storage (for the per-space setting), and page-content summaries (to receive the page-published event for automatic conversion).
• Permission checks. Actions from the page menu run with the user's own Confluence permissions, so the app cannot change a page the user could not change. Changing a space setting requires space-administrator rights, checked on the server, not only by hiding the screen.
• No stored content. Page content is processed in memory and never stored or logged. See the privacy policy: https://mathwrap.piptim.com/privacy/
• Bundled rendering. KaTeX and MathJax are bundled with the app and run without network access. Formula rendering uses KaTeX with trust: false, so formulas cannot embed links, scripts or HTML.

Scope

In scope: the MathWrap for Confluence app. Out of scope: Confluence itself and the Forge platform — report those to Atlassian (https://www.atlassian.com/trust/security/report-a-vulnerability).