Diagram & Math Studio security
Release preparation policy, 22 October 2026. The app is not registered or deployed; these statements describe the current package.
Architecture and data protection
The app uses a Forge Custom UI resource with no backend resolver, remote service, external fetch permission, API scope or separate storage. Source lives in Confluence macro configuration. Access and encryption are managed by Atlassian's platform; Atesen stores no separate page-content copy.
Renderer boundaries
DOMPurify cleans generated HTML/SVG. Mermaid uses strict mode; links, external images and initialization directives are rejected. KaTeX runs with trust disabled and bounded expansion. CSV is inserted as text nodes. Markdown removes external media, links and active HTML.
Inputs are bounded; renderers and fonts are packaged locally. Inline styles are permitted for renderer output. No arbitrary script/eval permission is declared. Production requires an active license; missing runtime context fails closed.
Vulnerability management and release checks
Dependency auditing and browser XSS/no-egress tests are part of release validation. Report a vulnerability privately to support@atesensoftware.com with a fictional reproduction and affected version. Do not include credentials or customer page content. Reports are investigated and fixes are verified before release; no fixed remediation deadline or service level is promised.
Actual Confluence PDF export and deployment validation remain pending. No security certification, third-party audit or Runs on Atlassian badge is asserted.