PeakDevs

Security and data

For Confluence admins and security reviewers. In short: the app reads the page a diagram is on, draws it in the reader's browser, and stores and sends nothing.

What the app asks for

Permission Why
Read pages and blog posts (read:page:confluence) A macro with no text of its own draws a Mermaid code block from the page it is on, so it reads that page. It also reads the page's draft while you edit, so the editing window can show the block.
Inline styles (styles: unsafe-inline) Mermaid colours and positions the parts of a drawing with inline styles. Without this, diagrams would draw without their colours and layout.

That is all. The app has no permission to write or delete content, to read attachments, spaces, users or comments, to store data, or to contact any address outside Confluence.

  • The page is read on behalf of the person viewing it, so the app sees only pages that person can already see.
  • A macro reads only the page or blog post it sits on, and only when it draws from a code block on the page.
  • The permission itself would allow reading other pages that person can see; the app does not use it for that. Confluence offers no permission limited to the current page.

What the app stores

Nothing. It has no database and uses no app storage. The diagram text is ordinary page content: Confluence keeps it in your page, in your site, under your page permissions and your data-residency settings. A macro's settings (such as Always light) are saved by Confluence with the macro on the page.

What the app sends

Nothing. The app has no permission to reach any address outside Atlassian, so Atlassian's platform blocks its calls to the outside. Diagrams are drawn in the reader's browser, inside the frame Confluence gives the app. Atlassian's platform does allow images from a few outside hosts by default, so the app adds its own checks:

  • The drawing code refuses or removes anything in the diagram text that would load from a web address: image shapes, images in labels, and styles that point at a file. See Limits.
  • Each page the app shows carries its own content security policy that blocks images, fonts and media from outside, as a second line of defence.

For export, Confluence calls one small function of the app that runs on Atlassian's own platform (Forge). It receives the macro's text, returns it as a code block for Word, and keeps nothing and logs nothing.

Runs on Atlassian

The app is built on Atlassian Forge and uses only Atlassian-hosted compute, no storage and no outside calls, which is what Atlassian's "Runs on Atlassian" programme looks for.

Text that someone else writes

A diagram's text is written by your users, and a page can be edited by many people. The app treats that text as data, never as code:

  • Mermaid draws in its strict security mode: HTML in labels is cleaned, and click actions and scripts are off.
  • Our automated tests put script into diagram text, drawn and broken, and check that it never runs.
  • Every release is tested under Confluence's content security policy and must cause no violation.

Who can see what

Readers see a diagram only on pages they may already open. Nobody at PeakDevs can see your pages or your diagrams: the app sends us nothing. If you write to support, we see only what you send us.

More