HTML BlockSecurity
Effective 03/11/2026. This page is for security reviewers evaluating HTML Block - HTML, CSS & JavaScript for Confluence, provided by Wattlebrooks Apps.
Runs on Atlassian
HTML Block is built on Atlassian Forge and runs entirely on Atlassian's platform. It is eligible for the Runs on Atlassian program: the app has no outside connections, and the only data it keeps (the guardrail settings) is held in Atlassian-hosted storage.
Permissions
| Permission | Why |
|---|---|
read:attachment:confluence | List a page's attachments and read the HTML file an author chose as a block's source. |
storage:app | Keep the two site-wide guardrail settings (Allow JavaScript, Maximum safety profile). |
That is the complete list. No write permissions on content, no admin permissions, no user permissions and no outside network access are requested.
How author code is contained
- Safety profiles: every block is cleaned according to its profile before it renders. The default, Standard, removes all scripts and event handlers. The editor shows exactly what was removed.
- Admin guardrails: a Confluence admin can turn author JavaScript off for the whole site and cap the loosest profile any block may use. Authors can choose stricter settings, never looser. The guardrails are enforced when each block renders, not just in the editor.
- Isolated sandbox: every block renders in its own sandbox, separate from Confluence and from the app. Author code, including allowed JavaScript, cannot read Confluence data, cookies, sessions or other page content.
- Size limits: 100 KB of code per block and 10 MB per attached file.
- No outside content: blocks cannot include HTML from a web address, so the app never fetches content from outside your site.
Access control
- Every attachment read is made as the person viewing or editing the page, so each person only sees files they could already open in Confluence. The app has no app-level view of your content.
- Guardrail settings can only be changed from the app's page in Confluence administration, which only Confluence admins can open.
- All access uses Atlassian's own sign-in. The app never asks for API tokens or passwords and holds no credentials or secrets.
- Block code is saved by Confluence with the page, and only when the person editing the page chooses Save.
Data handling
- Stored by the app: two guardrail settings, with no personal data.
- No page content, cache or logs of block content.
- No outside servers, analytics, telemetry, AI or third-party services.
Compliance
HTML Block inherits the security and compliance posture of Atlassian Forge, which holds SOC 2 Type II and ISO 27001/27017/27018 certifications. The app itself has no separate certification and does not handle payment data; billing is handled by Atlassian. The app is reviewed by Atlassian as part of Marketplace approval.
Changes
Each release is described in the What's new section of the Marketplace listing.
Reporting a problem
If you think you have found a security issue, email support@wattlebrooks.com or raise a request. We aim to reply within 2 business days.