Page Properties Report & Export for Confluence
Security
Last updated:
Page Properties Report & Export for Confluence is provided by druidori s.r.o. This page describes the app's data flow, access permissions, safeguards, and how to report a security concern.
Access to Confluence
The app works through Atlassian's Forge platform with the signed-in user's Confluence permissions. Every request runs as the current user, so a report lists only pages that person is allowed to read. A restricted page is simply absent for readers who cannot see it. Adding the macro to a page never grants extra access: each reader's own permissions decide what they see, whoever set up the report.
The app requests read:page:confluence to read the content, titles, and dates of pages and blog posts, and search:confluence to find the pages that have a Page Properties macro. It has no write scope and makes no page-write requests. The report's settings are saved in the macro by the Confluence editor when someone who can edit the page saves them. The app never asks for your Atlassian password or API token.
Where page data goes
The report and its downloads are created in the reader's browser. The app calls Confluence's REST API as that reader: a CQL search for pages with Page Properties, then those pages' content, titles, space names, and created and updated dates. The app has no vendor backend, app data store, or connection to an external service. It does not send page data to druidori or collect usage analytics.
When someone exports the page to PDF or Word, or views an older version in the page history, Confluence asks the app for the report as a static table. An Atlassian-hosted Forge function then performs the same read as that user, with that user's permissions, and returns the table to Confluence. It stores nothing.
Atlassian hosts the app interface and the export function, and handles the Confluence requests. A downloaded Excel or CSV file is an ordinary file: it holds the report's values and a link to each page. Treat it like any other export of Confluence content. Your device, spreadsheet application, and any file-sync or sharing service you use determine who can access it.
Safeguards
- The app's scopes are read-only. It cannot create, change, or delete pages.
- Each reader's own Confluence permissions decide which pages are listed and downloaded. The same applies to the person exporting the page to PDF or Word.
- The report's settings live in the macro on the page. Only people who can edit the page can change them; the app keeps no settings or page data of its own.
- The app declares no external fetch destinations and has no remote backend.
- Excel downloads store text as literal strings, and CSV downloads neutralise values that look like formulas, so text is not evaluated as a formula.
Report a security concern
Email info@druidori.com with the subject Page Properties Report security report. Describe the suspected issue, its impact, the steps to reproduce it, and your browser and app version if known. Use a small synthetic example where possible.
Do not send passwords, API tokens, or real Confluence exports or report downloads. Start with a description if the evidence contains personal or sensitive information. Test only content and systems you are authorised to access.
Security reports are reviewed for impact and reproducibility. Confirmed app vulnerabilities are handled under the applicable Atlassian security bug-fix policy. Ordinary support availability does not replace applicable security or incident-notification duties.
Support and privacy
Information you choose to send by email is separate from normal use of the app. The privacy notice explains how support correspondence and other business information are handled. See support for ordinary questions.