Skip to main content

CVD Portal app for Jira

The CVD Portal app for Jira copies vulnerability reports from your portal into a Jira project, so your engineers triage them where they already work. Install it from the Atlassian Marketplace. The app is free and works on every CVD Portal plan, including Free.

The app writes to Jira in one direction only. It creates and updates Jira issues from CVD Portal reports. It does not change anything in CVD Portal, and a Jira status change does not move the report.

What the app copies​

Each report becomes one Jira issue holding the report status, the severity, the product, the CVSS score, the description, the steps to reproduce and the impact. The issue also carries a link back to the report in CVD Portal.

Reporter contact details never leave CVD Portal. The email address, the PGP key and your internal notes are not copied. A Jira project is usually visible to more people than the report is, and the researcher did not agree to that when they filed. Open the report in CVD Portal to contact the researcher.

Set up the app​

  1. In CVD Portal, open Settings, then API Keys.
  2. Select New API Key. Give it a name such as Jira app.
  3. Select the scope forge:submissions:read. The key must carry only forge: scopes.
  4. Select Create key. Copy the key. CVD Portal shows it once and cannot show it again.
  5. In Jira, open the project you want the reports in.
  6. Select CVD Portal in the project sidebar.
  7. Paste the key, choose the issue type to create, then select Save.
  8. Select Sync now to run the first sync immediately.

The app then syncs every five minutes.

You need the Admin role in CVD Portal to create a key, and Jira project administration rights to configure the app.

What the first sync does​

The first sync brings in the most recent 50 reports, not your whole history. This stops a new install from creating thousands of Jira issues at once. Each later sync brings in up to 50 reports that changed since the previous run. If more reports changed, the next runs bring in the remainder.

How updates work​

The app puts a label on each issue that identifies the report it came from. A later sync finds the issue by that label and updates it, so a report that changes status updates its existing issue instead of creating a second one.

Do not remove that label. An issue without it is treated as missing, and the next sync creates a replacement.

If the sync stops​

Open the CVD Portal page in your Jira project. It shows the result of the last run.

MessageCauseFix
no-api-keyNo key is saved.Paste a key and save.
not-configuredNo issue type is chosen.Choose an issue type and save.
CVD Portal 401The key is revoked, expired, or lacks the forge: scope.Create a new key and save it.
Jira create failed 400The chosen issue type needs a field the app does not set.Choose a simpler issue type, or make that field optional.

A failed report stops the sync at that report and keeps its place. The next run retries from the same point, so nothing is skipped. Fix the cause and the queue drains on the next run.

Remove the app​

The CVD Portal page in Jira has no disconnect control. To stop the sync, revoke the key in CVD Portal under Settings, then API Keys. The next sync then fails with CVD Portal 401. Jira issues already created stay where they are.