What content can Security for Jira scan?

Currently, Security for Jira scans work item descriptions, including history, and comments on work items.

Note that attachments, work item summaries (titles), and custom fields are not yet scanned.

Permissions

Due to Jira Cloud’s permissions model, Security for Jira can only scan work items which it has permission to read. By default, Security for Jira has read permissions for all spaces.

This means:

• If Security for Jira’s read permissions for a space are explicitly removed, that space will no longer be able to be scanned.

• If an work item’s viewing is restricted such that Security for Jira cannot view it, it will not be scanned when a space Scan is run, nor will it be selectable in the Scan Report.

• If space scan has findings, but then the work item is restricted, the Security for Jira scan report will not be able to display the finding. Security for Jira does not store any potentially sensitive content.