Local Utility
Works.

Security

Small scope.
Clear boundaries.

The security design of Internal Link Integrity for Confluence.

Marketplace publication pending. This describes the planned 4.0 release build, which is not yet available to customers. Installation and pricing will open after release approval. Please use synthetic examples for inquiries; do not send Confluence content.

Forge-only design

The app’s interface and resolver run on Atlassian Forge. There is no external application backend, remote scan service, or Local Utility Works customer-content database.

No external customer-content egress is configured by the app. Scan processing stays within Atlassian and the requesting browser view. This describes the app’s architecture, not every network request or telemetry event generated by Atlassian host pages or the browser.

Three permissions, defined purposes

  • read:page:confluence: read supported saved pages and target evidence as the requesting user.
  • storage:app: store the installation’s small approval and replay-protection record, not scanned page bodies or reports.
  • read:confluence-user: transiently verify the current requester’s administrator authority for organization-record export. This is not a user-directory enumeration feature.

Organization approval, trusted identity and applicable entitlement checks precede new scan content requests. Confluence applies the caller’s page permissions. An installation does not bypass restricted pages.

The app makes no page-content writes or permission changes and does not request customer API tokens. Company authorization records can be updated through the separately controlled signed approval process.

A short data path

  1. You request a checkOpen the page action or start a space scan.
  2. Forge reads and checksRead permitted page data and assess supported target identity.
  3. Your view shows a reportReview results and coverage held in view memory.

Source page bodies are parsed transiently inside Forge. The browser receives the link and page information needed for the report, not wholesale source content. The app does not log page bodies, link text, URLs, or account-identifying customer content.

There is no persistent scan-history or page-content database. The available report can be downloaded as JSON; copies made by the user remain under that user’s control. A small installation approval record is stored separately in Forge and can be exported by an authorized administrator. Clear, refresh, or close ends the report session; an already invoked bounded operation may finish. This is not an immediate physical-memory erasure guarantee.

Atlassian platform telemetry and separately submitted support or business communications have their own data lifecycle. See the privacy policy.

User initiated and bounded

There is no scheduled crawler, automatic retry loop, external website crawling, or background continuation. The space view waits for your request; opening the page action is itself a check request.

A space scan is bounded to 100 source-page attempts, 500 unique target checks, and a 120-second operation budget. Per-operation and content bounds also apply. Rate limits, cancellation, and failures remain explicit. See scan limits.

The app never repairs a link or changes a page automatically. Any edit or restoration happens separately in Confluence, under your control.

Conservative classifications

Valid requires readable matching page identity. Trashed requires positive readable lifecycle evidence. An access denial does not prove existence or deletion, and an ambiguous 404 remains Unknown.

Unsupported and uncompleted work remain visible. COMPLETE and PARTIAL describe coverage rather than promising that every page or link is healthy. See result meanings.

We make no claim of an independent security certification, audit, bug bounty, or Marketplace security badge. Atlassian’s platform certifications are not certifications of Local Utility Works.

Report a vulnerability

Email security@localutilityworks.com for a suspected vulnerability in the app or this website.

Include the affected version or page, a concise description, and safe steps to reproduce using synthetic data. Do not send passwords, access tokens, customer page bodies, full reports, or unrelated personal data. Redact screenshots and addresses.

Use support@localutilityworks.com for routine product questions. Security reports are handled separately from the ordinary support response target; no emergency or 24/7 response commitment is stated here.