You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The permission scope suggests that code and metadata is read to synchronise development information to Jira. However when we've tested this out we're only seeing metadata being read from GitHub.
If the app was compromised, could it in theory exfiltrate all of our code from GitHub to a malicious actor or is it just metadata that is read from GitHub?
What we saw was that the information shared between Github and Jira is effectively links to commits. So in Jira you can see an individual commit, the commit comment, an indication of the scale of the change (lines added and deleted) and the names of the individual files that are changed. No code is shared or displayed in Jira.