Security Scanning with Snyk
We use Snyk to scan the following:
- Our deployment Docker images
- Application frontend dependencies
- Backend dependencies used for the Server & DC edition of our products
Atlassian Data Center Approval
Atlassian requires us to scan all of our backend dependencies using their own scanner to renew the certification of our apps for Atlassian Data Center every year. You can read more about it in Atlassian's Data Center SAST scanner documentation.
Ecoscanner by Atlassian
The Ecoscanner platform is a platform used for performing security checks against all Marketplace cloud apps on an ongoing basis. This will help Atlassian continuously monitor Marketplace cloud apps for common security vulnerabilities and improve the overall security posture of our ecosystem.
How findings are handled
Scanning only helps if findings are acted on. New high and critical findings are triaged against our bug fix policy, and fixes are released through the normal Marketplace update process. We re-scan after each change to confirm the finding is resolved rather than suppressed.
Scope
These scans cover the apps published by Realigned, the container images we deploy, and the third-party dependencies those apps rely on. They complement, rather than replace, the security testing performed by Atlassian for Marketplace approval.