Compliance Glossary for Confluence

Is Compliance Glossary eligible for Runs on Atlassian?

No. Forge CLI reports production version 6 as ineligible for Runs on Atlassian. The returned reason is App is egressing data. Its manifest declares one backend destination, https://api.github.com, for the optional GitHub connector. This result is an Atlassian program eligibility outcome. It is not a security failure, compliance verdict, certification, or statement that the app uses a vendor-operated backend.

Last verified against production v6 · 26 September 2026

At a glance

CheckVerified resultMeaning
forge eligibility -e production -v 6Version 6.0.0 in production is not eligibleForge CLI states: “App is egressing data.”
Production v6 manifestOne backend destination: https://api.github.comThe optional GitHub connector has a declared external provider boundary.
Default forge eligibility commandDevelopment version 5.0.0 is eligibleThis result does not describe production version 6.
Forge runtime, SQL, Object Store, and hosted LLMAtlassian-hosted modules remain presentForge hosting does not override the production eligibility result.
Future manifest without external provider egressNot assessedDeploy that version, then run the production eligibility check again.

How it works

  1. Identify the deployed environment and major version.
  2. Run forge eligibility --environment production --major-version 6 --non-interactive.
  3. Record the returned version, environment, result, and reason.
  4. Review permissions.external.fetch.backend in the matching manifest.
  5. Do not apply the Runs on Atlassian designation to production v6.
  6. Recheck after any deployed manifest or major-version change.

Example

A procurement reviewer asks whether production v6 carries the designation. The production command returns “not eligible” and identifies data egress. The manifest shows GitHub as the sole backend destination. The reviewer records the result without treating it as a vulnerability or compliance finding.

What this does not mean

This result was verified on 2026-09-26 with Forge CLI 13.3.0. It applies to production version 6.0.0. Eligibility is not security certification, compliance approval, residency proof, or vulnerability assessment. Optional use of GitHub still crosses the declared external provider boundary. A disabled connector does not change the deployed manifest result.

Related questions

Where does Compliance Glossary store data?How should security teams review the app?Which connectors are enabled?

Next step

Use the production environment, deployed major version, matching manifest, and Forge CLI result for every eligibility statement.

View on Atlassian Marketplace

Primary sources

Verification basis: production v6 code, tests, manifest, and operations guidance. Verified 26 September 2026.