1. Open and configure the app
- Install the app in a supported Jira Cloud site through its Marketplace listing.
- Open Apps in Jira administration, then open Jira Link Exposure Guard.
- Add trusted external hostnames to the allowlist when they should not be flagged as unapproved domains.
- Add organization-specific sensitive query-key names when needed, then save settings.
- Run an on-demand scan to confirm the configuration and review the latest result.
2. Understand the checks
The scanner can flag embedded username or password material, insecure HTTP, sensitive query-key names, tracking parameters, dangerous URL schemes, external domains outside the administrator allowlist, and canonical duplicate links. It analyzes URL text only; it does not request or test the linked website.
3. Review results
The result summarizes source requests, scanned issues, severity counts, truncation state, and up to 250 redacted findings. Findings may include bounded source identifiers, hostname, path shape, query-key names, and risk reasons. Full URLs, URL fragments, embedded credentials, query values, issue summaries, and description text are excluded from stored results and logs.
4. Manual and scheduled scans
A Jira administrator can start an on-demand scan. A licensed installation also runs one daily scheduled scan. Each run stops at 5,000 issues and retains only the latest scan record. If more than 250 findings exist, totals remain available and the stored result is marked truncated.
5. Permissions and data
- read:jira-work reads issue-description content needed to identify explicit links.
- storage:app stores current settings and the latest bounded redacted report in Forge app storage.
The app declares no Jira write scope, remote backend, or external egress. See the app-specific data table for the complete disclosure.
6. Delete the latest report
Use Delete stored report in the admin page to remove the latest scan record. Saved settings remain until changed or the installation data is handled through Atlassian’s app lifecycle.
7. Troubleshooting
No result appears
Confirm the app is licensed, the scan completed, and the installation has permission to read Jira work. Large sites may take longer because the scan paginates through eligible issues.
A trusted domain is flagged
Add only the exact trusted hostname to the allowlist and run the scan again. Do not include a scheme, path, or query string.
A link is not reported
The app evaluates explicit links found in issue descriptions. It does not crawl attachments, linked websites, or content outside the app’s Jira read scope.
8. Support
Email contact@craigtechservices.com with the app name, approximate time, expected behavior, observed behavior, and reproduction steps. Do not send passwords, API tokens, full sensitive URLs, or unnecessary customer content.