JIRA Forms security

Question

I'm testing forms functionality because seems to be more clearly to use when user complete the fields.  The setup issues is for the request for vacations workflow, that i made with custom fields and automations.

But i'm worried about. I share the form by email link for a person that not have access to JIRA and let me entry to form, complete information and create the issue. Project is restricted to some users and forms is restricted to LImited, but let me share by email to person without access to JIRA and are not in project?

Its a security fail? Could yo confirm this functionality?

Thanks

Alejandra

Olha Yevdokymova_SaaSJet · Answer

Hi @Alejandra Martin 
If your are open to use apps, you may want to check Smart Forms for Jira developed by my team.

External Sharing is an Intended Feature — But Controlled by Settings

Smart Forms allows you to share forms via public URLs, even with users outside Jira. This is by design, especially for use cases like:

Customer feedback after support tickets

External vendor assessments

Intake from employees or stakeholders without Jira licenses

However, access to the form doesn’t grant access to the Jira project. The form is hosted through the add-on, not via native Jira permissions. It acts more like a secure intake portal than a Jira screen. Plus you may add CAPTCHA to protect your form from bots. 
For external sharing the form may be shared by link or via ember content on your website or Confluence. For example like that :

You can also limit access for certain cases

“Verified in instance”: Only users with access to your Jira instance (logged in) can access the form.

Anonymous responses: Prevents user tracking (useful for HR or post-mortem forms).

🛡️ Is it a Security Risk?

No, this is not a security failure — it’s a controlled, opt-in functionality for collecting structured data from external sources.

However, if the form is collecting sensitive or internal-only data, and you don’t want any non-logged-in users accessing it, you should:

Set access to “Verified in instance” (or “Only project users” depending on your setup).

Avoid sharing links outside your organization.

You can configure forms to:

Issue creation after form submission

Auto-assignment based on values

Select issue type from form

Select Assignee or Reporter

Trudy P Claspill · Answer

Thank you for sharing the image from your project Permissions Scheme.

I recommend that you double check the memberships of those roles in your project to make sure the user is not assigned to one of those roles. Perhaps a User Group has been added to one of the roles, and the user is a member of the group.

You can also ask the user to attempt to access your Jira site separately from the form by accessing the URL https://yourBaseURL/jira

If the user does not get a message about not having access, then somewhere in your Atlassian Cloud Organization administration you have a setting that is allowing them access.

If the user is successful in access your Jira instance with the the general URL, have them click on their avatar in the upper right corner and provide you with the information that appears there. Example:

Check the email address they provide against the email addresses of the users that have been assigned to the role. Look for that email address in you User list in the admin site. It is possible that they are using an identity cached in their browser rather than the one you think they are using, and that other identity might have access to your instance.

Alejandra Martin · Answer

Hi Trudy. Atlassian addon project assets role has permissions to create issues in our Scheme Permissions

This is important because in our model, we need to create issues manually in one project (vacations), and when its created, clone the issue in another project (calendar). So we have severals automations in that project and i understand for automation is neccesary assign atlassian-addons-project-access.  But no users are assigned to that role

In our Permission Scheme, grant operations to role Ingreso de Ausencias, Aprobador Nivel1, and Aprobador Nivel 2, then in project assign persons to a that role.

Moreover, when I sent form by mail, put a person that not becomes to JIRA, user is not in JIRA., not defined, not assigned to project.