Label Cleanup for Jira - Security

Last updated: 11/11/2026

Platform

Label Cleanup for Jira is built on Atlassian Forge and Runs on Atlassian. Atlassian hosts the app's code and storage; there are no Taskhooker servers, no outbound network calls, and no web triggers.

Permissions

Scope	Reason
read:jira-work	List labels, find work items by label, read a work item's labels, check the caller's Administer Jira permission
write:jira-work	Change the Labels field of work items in a confirmed job
storage:app	Job records, job history and label usage counts

No user, group, configuration, admin or Confluence scopes, and no external network access.

Access control

• The app is a Jira admin page, and every request is checked on the server for the Administer Jira permission before anything else happens.
• No change is written until an administrator confirms a dry-run preview, and only the previewed work items are changed.
• Only the Labels field is ever written.

Credentials

The app never asks for or stores passwords, API tokens or any other credentials. Atlassian handles all authentication.

Report a security issue

Email security@taskhooker.com. We acknowledge reports promptly and follow the Atlassian Marketplace security bug fix policy.