What all access rights a marketplace app has? (=max exposure for a supply chain attack)

[Guy]

There are many apps on marketplace, let's say about JIRA product.

If I install an app, assuming no further access requests is given (not sure there is actually), what can this app know (inquiry) and do (change) about my site or product?

Then a user starts to use the app, does the app have the same rights as the user currently using it, or higher?

In a simple question, what is the maximum security exposure I risk when installing an app?

thanks!

guy

[marc -Collabello--Phase Locked- · Accepted solution]

Hi @Guy ,

Each app on the marketplace lists its access rights.  E.g. some apps have read-only access, whereas others have admin access.  Your Jira admin should understand what apps can and can't do.

[Guy]

That simple indeed !! Listed at install time. My admin explained me.

THanks

[Guy]

A good link to understand better

https://confluence.atlassian.com/upm/atlassian-connect-app-scopes-445186491.html