Security

Effective 5 September 2026 · Version 1.0

How to report a vulnerability in Exakind Tables, what we commit to in reply, and — because it shortens most conversations — what the app's attack surface actually consists of.

01 Reporting a vulnerability

Email support@exakind.com. There is no separate security address and no form to fill in — the same inbox reaches the same person.

Useful things to include, in rough order of usefulness:

• What you did, in enough detail to repeat it.
• What happened, and what you expected instead.
• The Confluence page state — a table with merged cells, an unusual number format, an enormous row count — since the app's behaviour is entirely a function of the table it is given.
• Browser and version, if the behaviour looks rendering-related.

What we commit to: an acknowledgement within two business days, an assessment and our reasoning, and — if there is a fix — a note when it ships. We do not commit to a fix deadline, because committing to one we might miss would be worse than saying this.

02 What the app's surface actually is

Most security questions about a Confluence app are about its backend, its stored data and its API permissions. Exakind Tables has none of the three, and that is a structural fact rather than a policy:

• No permissions. The manifest declares an empty scope list, so Atlassian grants the app no access to your pages, spaces, attachments, users or Jira issues.
• No storage. No database, no Forge storage, no key-value store, no cache. Your filters and sort exist in memory while the page is open.
• No outbound network calls. No analytics, no error reporting, no third-party services, no external fonts. There are no sub-processors because there is nothing to sub-process.
• No backend. The app is one macro module. There is no function, no resolver and no server of ours anywhere in the path.

The absence of network calls is enforced mechanically, not by review. Two independent checks run on every commit: one walks the code and fails the build on any import outside a short allowlist, the other fails on any reference to fetch, XMLHttpRequest, WebSocket, sendBeacon or a known HTTP client. Both have been tested by deliberately breaking them.

03 What is in scope, and what is not

In scope: the Exakind Tables app, and this website.

Not in scope: Atlassian's own products and infrastructure, which is where the app runs and where your content lives. Issues in Confluence itself belong to Atlassian's own security programme, not to us — and reporting them here only delays them reaching someone who can act.

04 Testing

Test against your own Confluence site, with your own content, using a table you own. Please do not test against other people's sites, do not attempt denial of service, and do not access or modify data that is not yours. Research done within those lines is welcome and we will not pursue it.

05 Related

What the app can see, store and send is set out in full in the privacy policy. How the app behaves, including what it infers and how to override it, is in the documentation.