CVD Portal app for Jira
The CVD Portal app for Jira copies vulnerability reports from your portal into a Jira project, so your engineers triage them where they already work. The app is not yet listed on the Atlassian Marketplace. Contact support@cvdportal.com if you want to use it before the listing is live. The app is free and works on every CVD Portal plan, including Free.
The app writes to Jira in one direction only. It creates and updates Jira issues from CVD Portal reports. It does not change anything in CVD Portal, and a Jira status change does not move the report.
What the app copies
Each report becomes one Jira issue holding the report status, the severity, the product, the CVSS score, the description, the steps to reproduce and the impact. The issue also carries a link back to the report in CVD Portal.
Reporter contact details never leave CVD Portal. The email address, the PGP key and your internal notes are not copied. A Jira project is usually visible to more people than the report is, and the researcher did not agree to that when they filed. Open the report in CVD Portal to contact the researcher.
Set up the app
- In CVD Portal, open Settings, then API Keys.
- Select New API Key. Give it a name such as
Jira app. - Select the scope
forge:submissions:read. The key must carry onlyforge:scopes. - Select Create key. Copy the key. CVD Portal shows it once and cannot show it again.
- In Jira, open the project you want the reports in.
- Select CVD Portal in the project sidebar.
- Paste the key, choose the issue type to create, then select Save.
- Select Sync now to run the first sync immediately.
The app then syncs every five minutes.
You need the Admin role in CVD Portal to create a key, and Jira project administration rights to configure the app.
Who can change the setup
The app keeps one setup for the whole Jira site, so all reports go to one project. The CVD Portal page shows in every project, but the app checks the Jira permissions of the person who uses it.
| Action | Who can do it |
|---|---|
| Save the key and the issue type | An administrator of the project, or a Jira site administrator |
| Select Sync now or Disconnect | An administrator of the synced project, or a Jira site administrator |
| Move the sync to another project | A person who administers both projects, or a Jira site administrator |
| See whether a key is saved and the result of the last run | An administrator of the synced project, or a Jira site administrator |
Other people see which project receives the reports, and nothing else.
To move the sync, open the CVD Portal page in the new project. The page names the project that receives the reports now. Choose an issue type, then select Move the sync. New and changed reports then go to the new project. Issues that the app already created stay where they are, and a later change to one of those reports updates its existing issue.
A Jira site administrator can also move the sync away from a project that was deleted.
What the first sync does
The first sync brings in the most recent 50 reports, not your whole history. This stops a new install from creating thousands of Jira issues at once. Each later sync brings in up to 50 reports that changed since the previous run. If more reports changed, the next runs bring in the remainder.
How updates work
The app puts a label on each issue that identifies the report it came from. A later sync finds the issue by that label and updates it, so a report that changes status updates its existing issue instead of creating a second one.
Do not remove that label. An issue without it is treated as missing, and the next sync creates a replacement.
If the sync stops
Open the CVD Portal page in your Jira project. It shows the result of the last run.
| Message | Cause | Fix |
|---|---|---|
no-api-key | No key is saved. | Paste a key and save. |
not-configured | No issue type is chosen. | Choose an issue type and save. |
CVD Portal 401 | The key is revoked, expired, or lacks the forge: scope. | Create a new key and save it. |
Jira create failed 400 | The chosen issue type needs a field the app does not set. | Choose a simpler issue type, or make that field optional. |
A failed report stops the sync at that report and keeps its place. The next run retries from the same point, so nothing is skipped. Fix the cause and the queue drains on the next run.
Remove the app
Open the CVD Portal page in the synced project and select Disconnect, then select it again to confirm. The app deletes the API key from Jira and stops the sync. Jira issues already created stay where they are.
Then revoke the key in CVD Portal under Settings, then API Keys, so that no copy of it works.
Related
- API authentication explains keys, scopes and expiry.
- Importing evidence from Jira and Confluence is a separate feature that reads Jira into CRA evidence. It uses its own connection and is not this app.