Security policy

Last updated 30 September 2026.

This policy covers Faithful Markdown Export for Confluence, published on the Atlassian Marketplace by Second Tiger (두번째호랑이, business registration 670-56-01033, Republic of Korea). It explains how to report a security problem, what we commit to doing about it, and what happens if something goes wrong.

Reporting a vulnerability

Email yjkwon@winm2m.com with whatever you have. What helps most:

• what you did, in enough detail that we can reproduce it
• what happened that should not have
• the app version, and the Confluence site type if it matters
• how you would like to be credited, if you want to be

We will confirm receipt, tell you what we think the severity is and why, and keep you posted until it is fixed. We ask that you give us a chance to ship a fix before describing the issue publicly. We will not take legal action over good-faith research.

You can also report Marketplace app vulnerabilities to Atlassian directly, and Atlassian will route them to us.

How fast we fix things

Severity is assessed with CVSS. As an Atlassian Marketplace partner we are held to Atlassian's published deadlines for cloud apps, measured from the point the issue is reported to Atlassian:

Fixes reach you without any action on your part: the app is a Forge app, so a deployed version is picked up by every installed site.

If there is an incident

We keep a written incident response plan rather than improvising. In short: we contain first, notify Atlassian within 24 hours of discovering an incident, post progress at least every six hours until it is resolved, tell affected customers what happened and what it means for them, and publish a post-incident review of what we changed so it does not happen again.

Why the blast radius is small

This matters more than any policy text: there is very little here to steal.

• The app stores nothing. No Forge storage, no database, no cache, no logs of its own. Conversion happens in your browser and is discarded when you close the tab.
• Read-only access. Four read scopes, no write scopes. The app cannot change or delete anything in your site.
• No external egress. The app declares no outbound hosts and contacts no third-party service. This is what qualifies it for Atlassian's Runs on Atlassian programme.
• It reads as you. Every read uses your own Confluence permissions, so the app cannot reach content you cannot already see.

The realistic risk is therefore not a data breach on our side but a compromise of the supply chain — a dependency or the release path. That is where our attention goes.

How we keep the code honest

• Automated dependency scanning on the source repository, with security updates enabled and a weekly scan of every manifest. The app ships two runtime dependencies, both Atlassian's own Forge packages.
• A public conformance suite. Every release is scored against open rules, an open corpus and an open scorer, so correctness claims can be checked rather than taken on trust: confluence-markdown-conformance.
• Least privilege by construction. Scopes are reviewed on every release; if a feature would need a write scope, it does not ship without saying so here first.

What we do not claim

We would rather be believed than impressive. As of this date:

• the app is not part of the Marketplace Bug Bounty programme
• we do not commission external penetration tests
• we hold no compliance certifications such as ISO 27001 or SOC 2

Second Tiger is a one-person business. If any of the above changes, this page changes with it.

Contact

yjkwon@winm2m.com — security reports, and anything else on this page.