Incident Response Plan

Overview

This plan covers actual or suspected security incidents affecting Community Questions for Confluence, its Atlassian integration, services, data, infrastructure, operational accounts, deployment pipeline, or third-party providers. It governs investigation, containment, recovery, communication, and follow-up.

What counts as an incident

An incident is any actual or suspected event that could affect the confidentiality, integrity, or availability of the app or customer data, including:

• Actual or suspected unauthorized access, disclosure, modification, destruction, or loss involving the app, its systems, accounts, or customer data, including cross-tenant access.
• Compromised credentials, secrets, signing keys, tokens, or similar access material.
• Active exploitation or a serious vulnerability that cannot safely wait for normal patching.
• A provider or app issue that affects customer data, materially affects Atlassian systems, or weakens the app's ability to protect customer data.

Response steps

1. Investigate and preserve evidence. Record the source, time, affected systems, suspected customer and data impact, and immediate risk. Preserve relevant logs, alerts, deployment records, provider notices, and customer reports where feasible. Establish the timeline, scope, affected customers or tenants, involved data or credentials, root cause, and whether exploitation is ongoing.

2. Contain the incident. Stop further harm by rotating secrets, restricting access, disabling affected paths, blocking suspicious activity, pausing unsafe integrations, or coordinating containment with Atlassian and providers.

3. Remediate and recover. Fix the affected code, dependencies, permissions, configuration, infrastructure, or provider settings. Deploy the correction, verify the affected path and recovery, and monitor for recurring indicators.

4. Communicate. Notify Atlassian, affected customers, providers, or other required parties according to the requirements below.

5. Record and conduct a post-incident review. Document the timeline, evidence, decisions, root cause, remediation, verification, notifications, and follow-up. Confirm resolution, identify lessons and corrective actions, and update controls or documentation where needed.

Notification

For a Marketplace app security incident, raise a P1 incident ticket with Atlassian within 24 hours of becoming aware of it. During remediation, provide Atlassian with progress and action updates at least every six hours and whenever material facts change.

Notify affected customers when required by law, contract, Atlassian guidance, or incident impact. Keep notices factual and explain what happened, the likely time period, affected data types, actions taken, any action customers should take, and how to contact support.

Current Atlassian references:

• Atlassian Marketplace Security Enforcement Policy
• Atlassian App security incident management guidelines
• Atlassian Partner Security Incident Response Program

Records and review

Restrict incident records to those who need them for response, legal, privacy, or operational reasons. Keep only the information needed to understand and close the incident; do not store secrets, private keys, access tokens, raw authorization headers, or unnecessary personal data.

Review this plan after material incidents, meaningful app or infrastructure changes, and changes to Atlassian Marketplace incident guidance.

Contact

Security issues and suspected incidents can be reported to support@communityquestions.io.

Last updated: 2026-07-28