BacklogBridge Diagram Lens for Confluence

Diagram Lens Security

Security posture, architecture, permissions, and data flow for Diagram Lens.

App: BacklogBridge Diagram Lens for Confluence

Effective date: 8 July 2026

Security contact: support@backlogbridge.com

Support contact: support@backlogbridge.com

Architecture

Diagram Lens is a Confluence Cloud Forge app.

Primary components:

  • Forge macro module for Confluence pages.
  • Custom UI resources for page view, configuration and editing, and wide viewer.
  • Forge resolver for app-owned diagram configuration.
  • Forge export fallback behavior for Confluence export flows.
  • Atlassian Forge hosted storage for saved diagram configuration.

Diagram Lens has no vendor-hosted backend.

Permissions

Current manifest scope:

permissions:
  scopes:
    - storage:app

storage:app is required to save app-owned diagram configuration and saved viewer state keyed by the macro local ID. This lets Diagram Lens save title, Mermaid source, theme, layout, zoom, and viewport preferences.

No external egress permissions are declared in the current manifest.

Data Flow

  1. A user enters Mermaid source, title, theme, layout, and viewer preferences.
  2. The app saves configuration to Atlassian Forge hosted storage.
  3. The Custom UI frame reads the stored configuration through the Forge resolver.
  4. Mermaid renders the diagram client-side inside the Forge iframe.
  5. Rendered SVG is sanitized before display or export.
  6. Exports are generated locally in the browser when requested by the user.

The app is designed not to send diagram source or rendered output to external vendor services.

Mermaid Security Controls

Diagram Lens uses:

  • Strict Mermaid security settings.
  • Disabled HTML labels.
  • Blocking for Mermaid security-level overrides.
  • Blocking or sanitization for JavaScript URLs and active click actions.
  • Warnings for safe click syntax because strict rendering strips interactivity.
  • Warnings or blocking for raw HTML labels depending on risk.
  • DOMPurify sanitization of rendered SVG before display and export.
  • Source-size warnings and blocking before oversized sources are rendered.

SVG and Export Controls

SVG export uses normalized and sanitized SVG output.

PNG, PDF, and clipboard image export rasterize the sanitized SVG in the browser. These paths are best effort and report errors when browser, permission, size, or canvas limits prevent export.

No-Egress Design

Current implementation:

  • No vendor-hosted backend.
  • No external analytics.
  • No AI service calls.
  • No remote Mermaid renderer.
  • No external fonts or app-owned assets fetched from outside Forge-hosted resources.

Residual Risks and Mitigations

Risk Mitigation
Users paste sensitive information into diagrams. The privacy policy states that diagram source is user-controlled and stored in app storage.
Mermaid parser or render bug. Strict config, source risk blocking, DOMPurify sanitization, and security fixture tests.
Export failure on large diagrams. SVG primary export, best-effort PNG/PDF, and explicit error handling.
Forge or Confluence CSP changes. CSP-safe style handling and regression validation before release.

Related Pages