Security is a shared responsibility between Atlassian and our Marketplace partners. As the Marketplace ecosystem grows and the threat landscape evolves, Atlassian continues to raise the bar on the security posture we expect from partners and their apps. This page brings together the security compliance areas that apply across all Marketplace apps so that partners have a single place to understand what we look for, where each requirement is documented in more detail, and how Atlassian approaches non-compliance when it occurs.
This page is intended to complement, not replace, the Marketplace Partner Agreement, the Atlassian Developer Terms, and the detailed security documentation linked throughout. Where a specific requirement is documented elsewhere on developer.atlassian.com, that document remains the source of truth.
Atlassian may modify, update, or expand this guidance at any time to address evolving security threats, ecosystem needs, or regulatory requirements. Partners are responsible for staying current with published guidance and maintaining ongoing compliance. Please watch the changelog and Developer Community for updates.
Atlassian performs ongoing monitoring of the Marketplace to identify apps and partners that are out of alignment with our published security requirements. This includes automated security scanning of app artifacts, review of disclosures made through the Privacy and Security tab, review of incident reports, and auditing of partner identity and business information.
The areas covered on this page represent the key domains where Atlassian expects partners to demonstrate continuous compliance:
Each section below outlines the expectation, where it is documented, and how to stay in good standing.
Vulnerabilities discovered in Marketplace apps, whether identified by Atlassian's scanners, reported through the Marketplace Security Bug Bounty Program, or raised manually, are logged as tickets in the Atlassian Marketplace Security (AMS) Jira project and assigned to the security contact provided by the partner.
Each ticket is assigned a severity based on the probable impact of the vulnerability, and each severity has a published remediation timeframe that determines the ticket's due date.
| Severity | Marketplace Cloud apps | Marketplace Data Center apps |
|---|---|---|
| Critical | 10 days | 12 weeks (84 days) |
| High | 4 weeks (28 days) | 12 weeks (84 days) |
| Medium | 12 weeks (84 days) | 12 weeks (84 days) |
| Low | 25 weeks (175 days) | 25 weeks (175 days) |
For the full policy, including CVSS-based severity definitions, the two-week triage window for Bug Bounty findings, and the limited conditions under which extensions may be granted, see the Security Bug Fix Policy for Marketplace apps.
| Ticket type | Source |
|---|---|
| Bug Bounty Vulnerability | Reports from the partner's Bugcrowd bug bounty program. See the Marketplace Security Bug Bounty Program. |
| EcoScanner Vulnerability | Atlassian's continuous scanning platform. See EcoScanner and Security Initiatives for Data Center Apps. |
| Security Vulnerability | Manually raised tickets from Atlassian's security team or from partner disclosures. |
Marketplace apps that rely on OAuth 2.0 or Three-Legged OAuth (3LO) must implement these flows securely and in accordance with Atlassian's published guidance. Atlassian maintains automated and manual review mechanisms to validate OAuth implementations.
Start with the primary OAuth documentation:
client_secret values in source code, configuration files, or
any client-side artifact that can be inspected by an end user.Every partner listing apps on the Atlassian Marketplace must complete Atlassian's identity and business verification process. This process validates partner legitimacy, establishes a durable business relationship, and satisfies regulatory obligations that apply to Atlassian as the Marketplace operator.
For a full walkthrough of what the verification process involves and how to complete it, see Due Diligence Business and Identity Verification for Marketplace Partners.
Partners are encouraged to engage with Atlassian early if any part of the verification process is unclear or if additional information is required.
Participation in the Marketplace Security Bug Bounty Program is a requirement for partners in the Marketplace Partner Program and for apps carrying a security trust signal such as Cloud Fortified. A healthy bug bounty program gives external security researchers a reliable channel to disclose vulnerabilities and demonstrates a sustained commitment to security improvement.
The Marketplace Partner Program ties bug bounty participation to each partner tier, with the scope widening as the tier advances:
Participation in the Marketplace Security Bug Bounty Program is also a prerequisite for Cloud Fortified approval.
Key documents:
As noted in the public transition guide, Atlassian is entitled to pause or deactivate bug bounty programs that are not in the process of going public by the compliance deadline, or that are consistently dormant or unhealthy.
As previously communicated to partners (CHANGE-2449 and the security requirements FAQ), Marketplace apps must not collect, transmit, or store Atlassian user account API tokens (personal access tokens, or PATs). This requirement supports customer data security and aligns with Atlassian's authentication modernization toward OAuth-based flows.
Personal access tokens used as a general app authentication mechanism introduce several categories of risk:
See the related guidance:
Security incident response is a shared responsibility between Atlassian and our Marketplace partners. As set out in the Forge shared responsibility model, Atlassian operates the underlying platform while partners are responsible for the security of their own app code, data handling, and customer-facing communications. Incident response sits squarely in that partner column: every Marketplace partner is responsible for preparing for, detecting, and responding to security incidents that affect their app, and for collaborating with Atlassian throughout the lifecycle of an incident. What varies across partners is the depth of Atlassian's involvement, not the underlying obligation.
All Marketplace partners are expected to maintain a documented security incident response process covering:
Atlassian scales its direct engagement to the risk profile of the partner and the app. Platinum Marketplace Partners and partners whose apps are used by Enterprise customers can expect closer, more hands-on collaboration from Atlassian's security team during an incident, reflecting the broader customer exposure of those apps. Partners at other tiers are still expected to follow the same core process, with Atlassian engaging commensurate with the risk.
For a walkthrough of what to prepare in advance, see Preparing for a security incident.
Partners must notify Atlassian of any security incident impacting a Marketplace app by raising a P1 incident ticket within 24 hours of becoming aware of the incident, and must provide:
See the App security incident management guidelines for the end-to-end process.
Partners should notify affected customers transparently and promptly. Use the App security incident communication template as a starting point and adapt it to the specifics of the incident.
Where customer data or systems are being actively exploited through a Marketplace app, Atlassian reserves the right to immediately suspend the app to protect the broader customer base, pending partner remediation and security verification. This is an existing emergency capability and is used only where the risk to customers would not be addressed in time through normal remediation channels.
Atlassian's strong preference is to resolve compliance issues collaboratively with partners. In the vast majority of cases, partners respond to AMS tickets, ECOHELP tickets, and direct outreach, remediate the underlying issue, and the app remains in good standing.
Where a compliance expectation is not met and remediation does not occur through normal channels, Atlassian has a range of remediation actions available, including:
In situations involving actual or imminent material harm to customers, clear evidence of malicious activity, or legal or regulatory obligations, Atlassian may act more quickly than the standard remediation flow would otherwise allow.
If you have questions about any of the areas on this page or need help planning a migration, please raise an ECOHELP ticket.
Rate this page: