The permission scope suggests that code and metadata is read to synchronise development information to Jira. However when we've tested this out we're only seeing metadata being read from GitHub.
If the app was compromised, could it in theory exfiltrate all of our code from GitHub to a malicious actor or is it just metadata that is read from GitHub?
What we saw was that the information shared between Github and Jira is effectively links to commits. So in Jira you can see an individual commit, the commit comment, an indication of the scale of the change (lines added and deleted) and the names of the individual files that are changed. No code is shared or displayed in Jira.
