Security policy
Effective date: .
Report a security issue
Report security issues for ColumnFit for Jira to security@jcb2consulting.com.
JCB2 Consulting monitors this address and reads the inbox at least daily.
Triage and response clocks
We record first receipt as T0 and assign an incident ID and a response deadline. Severity is triaged within the following windows; the production fix and the Atlassian-side update are due by the response deadline.
| Severity | Triage | Fix and Atlassian update |
|---|---|---|
| Critical | 1 day | 10 days |
| High | 2 days | 4 weeks |
| Medium | 1 week | 12 weeks |
| Low | 2 weeks | 25 weeks |
Clocks use calendar days and seven-day weeks. Earlier Atlassian deadlines apply, and triage does not restart the clock.
Acknowledgment
A reply from the monitored inbox acknowledges the report within the severity’s triage window and includes the incident ID. Fix details are not shared until the fix ships.
Reporter-safe handling
Reporter identity and report text stay in the restricted incident thread. Only redacted summaries enter repository evidence. No reporter detail is published or shared with a third party. Good-faith research is not pursued.
See the privacy policy for app data handling.