Security statement

Last updated: 11 November 2026

This statement covers the Confluence Cloud app "PeakDevs Mermaid Diagrams for Confluence" (the app).

How the app is built

• Platform: Atlassian Forge. The app runs only inside Atlassian's platform and the reader's browser. We run no servers of our own for it.
• Permissions: one data permission, read pages and blog posts (read:page:confluence), used to read the page a diagram is on. One display permission, inline styles, which Mermaid needs to draw. No write permission, no storage, no outside network access. Details: Security and data.
• No stored data: the app has no database and uses no app storage. Diagram text stays in your Confluence pages.
• No data leaves Atlassian: the app cannot contact any outside address, and it refuses or removes anything in a diagram that would load from one. Each of its pages also carries a content security policy that blocks outside images, fonts and media.
• No credentials: the app never asks for or handles passwords, API tokens or personal access tokens.

Text in diagrams is treated as data

• Diagrams are drawn with Mermaid's strict security mode. HTML in labels is cleaned; scripts and click actions are off.
• Automated tests run on every change: script written into diagram text must not run, and the app must draw with no content-security-policy violation in a real browser.

Keeping it up to date

• Dependencies, including Mermaid, are checked for known vulnerabilities before each release.
• We fix vulnerabilities in the app within Atlassian's Marketplace deadlines: critical within 10 days, high within 28, medium within 84 and low within 175.
• We update Mermaid when a security fix is published: a fix for a critical or high vulnerability is in the app within 5 working days, and we aim for 3.

Reporting a vulnerability

Email security@peakdevs.eu. Please include the steps to reproduce it and the app version if you know it. We confirm receipt within 2 working days and keep you informed until it is fixed. Please give us a reasonable time to fix it before you make it public.

If an incident affects customers, we tell Atlassian through its partner incident process and tell the affected customers as the law requires.

What we do not have yet

• No bug bounty programme of our own and no security certification (such as SOC 2 or ISO 27001).

Contact

Peak Devs, Shackletonstraat 12, 1056 RM Amsterdam, the Netherlands. Security: security@peakdevs.eu.