Filter Tabs for Jira Dashboards - Security
Last updated: 11/11/2026
Platform
Filter Tabs is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. Taskhooker operates no servers for it. The app is Runs on Atlassian eligible: no external network access, no remote back end and no inbound web triggers.
Permissions
| Scope | Why |
|---|---|
read:jira-work | Read saved filters, work item counts and search results so the gadget can show them |
That is the complete list. The app requests no write, admin, user, storage or external-fetch permissions.
Authentication and authorisation
Every request to Jira is made as the user viewing or editing the gadget, so Jira enforces that person's own permissions. The app never acts with app-level privileges. A viewer cannot see a work item, or a saved filter, through Filter Tabs that they could not already see in Jira; a filter that is not shared with them shows a clear message instead of results.
Data handling
- No Forge storage, no database, no cache. Results are shown and discarded.
- Gadget settings are stored by Jira on the dashboard, like built-in gadgets.
- No secrets, API keys or credentials are collected or stored.
- No analytics, telemetry, third-party SDKs or AI services.
Secure development
Core logic is covered by automated unit tests, written in strict TypeScript, and every release is built and deployed through Atlassian's Forge tooling. Dependencies are kept current.
Reporting a vulnerability
Please report security issues to security@taskhooker.com or through the Taskhooker support portal. We acknowledge reports within two business days and follow Atlassian's Marketplace security bug fix policy.