Secure Notes for Jira

Secure Notes: Encrypted by design, protected by the platform App provides zero-trust, burn-after-reading way to share sensitive information inside Jira, when only intended recipients can ever view it

Comment

Inspiration

Teams often need to share sensitive information during everyday work — temporary credentials, tokens, incident details, or any message that shouldn’t appear in comments, issue fields, or chats. Jira is the natural place where this information belongs, yet it provides no private, ephemeral channel for confidential communication.

Secure Notes for Jira emerged from the idea of creating such a channel directly inside Jira — without external tools, without separate systems, and with a strict zero-trust approach where only the intended recipients can ever decrypt the content.

The design is built on three principles:

  • Zero-trust: all encryption happens in the user’s browser, and the server never holds enough data to decrypt anything.
  • Burn-after-reading: encrypted content is permanently destroyed immediately after it’s viewed or expiration is reached.
  • No recovery: no secret or key material are ever stored, making it cryptographically impossible to restore a note later.

At the same time, organizations still require transparency and accountability. To support this, Secure Notes provides a structured audit trail available to administrators — without exposing the actual secret.

⸻

What it does

Secure Notes for Jira adds an encrypted note system directly inside Jira. It enables confidential communication with automatic expiration, one-time access, and comprehensive audit logging.

Secure Note Features

  • Create encrypted notes directly in Jira issues
  • Share with one or multiple recipients
  • End-to-end client-side encryption (AES-GCM)
  • One-time access with automatic self-destruction after viewing
  • Expiration options including 1 hour, 1 day, 7 days, 10 days, or custom

Audit & Compliance Dashboard A global page that provides following views:

  • My History — all notes you created or received
  • My Issue History — activity grouped by Jira issue
  • My Project History — activity grouped by Jira project
  • User History (Admin) — per-user activity across the entire site (w/o seeing actual secrets)
  • CSV export for compliance and reporting

Administrators can see:

  • When a note was created
  • Human-readable description (non-sensitive context string provided by the sender)
  • Which Jira issue it belongs to
  • Who created it
  • Intended recipients
  • When each recipient viewed the note

Rovo agent capabilities:

  • Provides audit trail in a natural language format according to user permissions
  • Creates summaries about shared secure notes, their frequency, top users, etc

Three-Layer Security Model

  1. Runs on Atlassian — the note lives fully inside jira site, with native isolation and governance.
  2. Strict access control — only authorized recipients can open the note.
  3. Client-side encryption — the key is generated in the browser and is never sent to Atlassian’s cloud.

Together, these layers ensure confidentiality even if infrastructure or metadata is exposed.

⸻

How we built it

Frontend: React + Vite (Forge Custom UI), multi-context UI (Issue Panel, Modal Dialogs, Global Page), Atlassian Design System, full theme support, client-side routing.

Backend: Forge Functions with @forge/api, @forge/sql, @forge/kvs, forge-sql-orm.

Shared: @forge/realtime, shared Backend-Frontend contract

ORM: forge-sql-orm (custom Drizzle-based ORM).

Storage:

  • Encrypted content → @forge/kvs.setSecret
  • Metadata (expiry, IV, salt, status, recipients) → Forge SQL

Security:

  • AES-GCM encryption performed entirely in the browser
  • PBKDF2-based key derivation (~200,000 iterations)
  • Key split into encryption + server-verification components
  • No plaintext ever sent to backend(atlassian infrastructure)
  • Multi-recipient validation via account ID matching
  • Scheduled Forge trigger cleans expired notes every 5 minutes

Audit System: A set of optimized SQL queries and indexed tables built on forge-sql-orm, with grouping by issue, project, or user.

⸻

Challenges we ran into

  • Designing a clean UX for a security-focused app while keeping workflows fast and simple
  • Coordinating multiple Forge contexts (Issue Panel, Modal, Global Page) with a single frontend codebase
  • Implementing client-side crypto with zero plaintext exposure to the backend
  • Handling multi-recipient notes with independent access tracking per user
  • Building a large audit dashboard without compromising performance
  • Enforcing strict one-time access semantics across Forge Functions and KVS
  • Managing deep links (/view/:noteId) in a global page inside the Forge environment
  • Ensuring everything stays Runs on Atlassian–compliant

⸻

Accomplishments that we’re proud of

  • Open-source project with MIT license
  • Created a practical development pattern for complex Forge solutions ensuring clarity, maintainability, and reliability
  • Adopted best code quality and tooling
  • Introduced pattern for caching and observability Forge SQL via forge-sql-orm
  • Successfully used newly introduced @forge/realtime
  • Successfully adopted Rovo agent
  • Built a full end-to-end encrypted system that stores no plaintext and no keys
  • Designed a modular security architecture built on Atlassian’s strengths
  • Delivered an app that is both secure and practical for real-world workflows
  • Kept the entire system Forge-native without any external services or servers

⸻

What we learned

  • How to use @forge/realtime and shared BE-FE contract with typescript model validation
  • How to work with Rovo
  • How to build a multi-context Custom UI application with clean state management
  • How to extend Forge SQL with a custom ORM and efficient indexed queries
  • How to design user-facing encryption flows that remain simple and intuitive
  • How to combine platform security (tenant isolation) with cryptographic security (E2E)
  • How to structure audit trails for compliance without storing sensitive content
  • How to add dependency injection with inversify library

⸻

What’s next for Secure Notes for Jira

  • Larger encrypted attachments (1–2 MB) using multipart Object Storage
  • Issue sidebar widget for fast note creation
  • Encrypted message threads inside an issue
  • Insights dashboards: sharing frequency, expiration patterns
  • Marketplace listing with free and Pro editions

Built With

Share this project:

Updates

posted an update —

Secure Notes Now Integrated with Jira Service Management

We are excited to announce that Secure Notes is now natively integrated into Jira Service Management (JSM). Agents can now securely share secrets (passwords, VPN configs) with customers directly inside the JSM Portal, while maintaining a strict Zero Trust architecture.

How We Guarantee Security

Client-Side Encryption

All encryption and decryption happen strictly in the browser using Web Crypto API.

Zero Knowledge Architecture

The decryption key is NEVER sent to Atlassian Cloud. It stays with the user and is destroyed after usage.

Native Experience

The app detects the customer context automatically, making the process seamless for Agents.

Video Demonstration

Watch the full demo (1:25): Watch the video Direct link: https://www.youtube.com/watch?v=WbE65Iwv-hE

What You'll See in This Video

Native JSM Integration

See how customers receive secure notes directly in their request view.

The "Invisible" Key

Watch how the key is generated locally and used for client-side decryption.

Burn After Reading

Verified wiping of encrypted data from the server immediately after access.

Bonus Feature

A sneak peek at Rovo AI acting as a Security Analyst to detect anomalies.

Conclusion

This is true End-to-End Security for the Atlassian ecosystem. Let us know your feedback!

Log in or sign up for Devpost to join the conversation.

posted an update —

Milestone: Marketplace Readiness & Compliance

As we move toward an official Atlassian Marketplace launch, we have formalized the legal and compliance side of the project. A security tool is only as good as the trust it builds, so we wanted to make our commitments explicit.

Secure Notes for Jira now has:

  • Dedicated Privacy Policy: Clearly defining our "Zero Egress" architecture. We explicitly state that we do not (and cannot) access your encrypted data or keys.
  • Terms of Use: Outlining the rights, responsibilities, and our BSL 1.1 licensing model (Source Available), ensuring transparency for future enterprise clients.

Both documents reflect the app’s zero-trust security model, encryption guarantees, auditability, and platform limitations.

You can review them here:

This is a key step in transforming Secure Notes from a hackathon prototype into a production-ready, enterprise-grade Forge app.

Log in or sign up for Devpost to join the conversation.

posted an update —

Secure Notes for Jira will remain Open Source license, even after the Marketplace launch.

In security, "trust" is not enough - verification is required. By opening our code, we allow any Security Officer to audit our encryption implementation and verify our "Zero Data Egress" promise.

Code can be copied, but the reputation of transparency cannot. We choose transparency.

Log in or sign up for Devpost to join the conversation.

posted an update —

While building Secure Notes for Jira, we paid special attention not only to security, but also to runtime performance and observability in real enterprise environments.

Initially, we integrated PostHog for external analytics. For the final submission, we decided to remove external analytics dependencies to keep the solution lightweight and fully Forge-native.

The Challenge: Performance vs. Visibility

We still wanted deep insight into database behavior. When a query exceeds a threshold (for example, >800ms), we need to capture EXPLAIN ANALYZE to understand why it was slow.

Previously, this diagnostic step was synchronous, which created a paradox: slow requests became even slower due to in-line analysis.

The Solution: Non-Blocking Diagnostics

We improved our forge-sql-orm layer to use Forge Async Events (@forge/events). Now, when a performance threshold is breached, the diagnostic task is offloaded to a background queue.

This allows the user request to complete immediately, while SQL analysis runs asynchronously in the background.

The Result

We get full visibility into real customer query behavior and execution plans without impacting runtime performance or user experience — staying fully Forge-native and Runs on Atlassian compliant.

For more details on the original observability design: https://community.developer.atlassian.com/t/practical-sql-observability-for-forge-apps-with-forge-sql-orm/97237

Log in or sign up for Devpost to join the conversation.

posted an update —

While Secure Notes ensures that the content remains encrypted (even the backend cannot see it), we realized that for Enterprise teams, knowing who, when, and in what context data was shared is just as critical. Here is how we solved the Audit & Compliance challenge using Runs on Atlassian (RoA) and Rovo AI.

1. The "Trust Proxy" Architecture

"Runs on Atlassian" is more than just hosting—it's the core of our security model. The Atlassian infrastructure acts as the trusted proxy for the key exchange. Without it, secure verified delivery wouldn't be possible. This architecture allows us to capture Contextual Metadata without compromising message privacy:

  • Descriptions: User-provided context about the note.

  • Issue & Project Context: Tracking strictly where the sensitive data flows.

We built dedicated Audit UIs:

  • Global Page: Users can track their own sharing history.
  • Admin Page: Administrators get a birds-eye view of all secure communication flows within the organization.

2. Next-Gen Security: AI Forensics with Rovo

(Note: While we are not submitting for the "Best Rovo Apps" category, we felt this integration was too powerful to leave out. We wanted to share how Rovo can be used for genuine Security Operations).

rovoAnalyses.gif

Standard audit logs are passive—you have to know what you are looking for. We asked: "Can AI find security threats for us?"

With our Forge SQL + Rovo integration, security moves to a new level. We don't just query data; we ask Rovo to find behavioral anomalies.

The Prompt:

"Find any unusual or suspicious activity related to Secure Notes usage."

The Rovo Result: Instead of a simple list, Rovo automatically formulated a complex investigation strategy.

The Agentic Workflow: Crucially, this is not a pre-coded "find anomaly" button. It uses the same single SQL action we use for standard reports. However, Rovo intelligently breaks down this high-level request and decides to execute multiple, distinct SQL queries to investigate different threat vectors in parallel. It autonomously decided to check for::

  • "Burner" Notes: Created and immediately deleted (potential testing or hiding tracks).

  • Bot Activity: Viewed within seconds of creation.

  • Mass Leakage: High volume sharing to multiple users.

Rovo successfully analyzed the SQL data and returned a Human-Readable Forensic Report:

"There are notes that were deleted within just a few minutes of being created... This can sometimes indicate accidental creation, testing, or attempts to hide activity."

This turns Rovo from a simple chatbot into an active Security Analyst, capable of enforcing compliance using Row-Level Security (RLS) to ensure admins see everything while users see only their own data.

Log in or sign up for Devpost to join the conversation.

posted an update —

As we wrap up our submission, we wanted to ensure that Secure Notes for Jira isn’t just a prototype, but a production-ready solution suitable for banking and enterprise environments.

Security first • 0 bugs and 0 vulnerabilities confirmed by Snyk and (SonarCloud)[https://sonarcloud.io/project/overview?id=vzakharchenko_Forge-Secure-Notes-for-Jira] • Zero-trust architecture: no external data egress, all secrets are encrypted client-side

Engineering excellence • 85% test coverage — core logic fully tested with Vitest • Type safety: 98.5% TypeScript codebase using Drizzle ORM for safe SQL execution • Clean architecture built with Inversify (DI) and the custom forge-sql-orm library

AI safety • Implemented the Guide + Guard pattern for Rovo • LLM-generated SQL is sandboxed and validated via AST to prevent unauthorized access • Full write-up: https://community.developer.atlassian.com/t/rovo-forge-sql-a-secure-pattern-for-natural-language-analytics-in-forge-apps/97028

github.png

Log in or sign up for Devpost to join the conversation.