FAQ

The obvious worry

Does the app store our secrets?

No. It stores a masked preview of four characters and a one-way SHA-256 hash used to recognise the same finding twice. The hash cannot be reversed.

Does anything leave Atlassian?

No. The app runs on Atlassian Forge and declares no outbound address whatsoever, which is why it qualifies for Runs on Atlassian.

Can SynapseOasis see our findings?

No. Everything is stored inside your own Atlassian site, and we have no access to it.

Does it use AI?

No. Detection is pattern-based, which is why it is deterministic and fast, and why you can add your own regular expressions.

Coverage

Does it scan attachments?

Text-based files up to 1 MB, when you enable it. Binary formats such as PDFs, images and archives are not read.

Does it scan Confluence?

No. This app covers Jira issues, comments, change history and attachments.

Will it find secrets in old tickets?

Only if you run a bulk scan. Real-time scanning starts from the moment you enable it.

Can I add patterns for our internal credentials?

Yes, as many as you like, with a test box to check them before saving. See Scanning rules.

Does it detect personal data as well as credentials?

Yes: card numbers, national identifiers such as SSN, CPF and CNPJ, phone numbers, IP addresses. Those categories can be switched off if they are noise for you.

Operating it

Will it slow Jira down for users?

No. Scanning happens after the event, outside the user's request. Nobody waits for it.

Should I enable auto-redaction?

Not at first. It permanently edits issue content. Enable it after a few weeks, when the findings have shown themselves to be accurate.

Who should own the findings queue?

Whoever can rotate credentials. A queue owned by someone who has to ask another team to act stalls immediately.

How do I prove to an auditor that we handle exposures?

Two things: the Analytics tab for the trend, and the Audit Log CSV export for who did what and when.

What happens when I uninstall?

The app erases what it holds: it empties the audit table and then sweeps its key-value store until nothing is left. Whatever remains is detached by Atlassian immediately and destroyed under its own retention policy. See Where your data goes. That includes the findings and the audit log, so export the audit CSV first if you need it. Remediation tickets stay in Jira.

What can we still do if the licence lapses?

Read and work everything you already have. Findings, analytics, the dismissed list and the audit log stay open, dismissing, resolving and restoring keep working, the CSV exports keep working, and every setting is still editable. What stops is the scanning: no new events are scanned, and Create Issue and Start Scan are disabled. Nothing is deleted, and renewing resumes it.

Does it manage schemes, screens, project roles or groups?

No, and it never has. An earlier build carried a large block of unreachable client code for those areas, copied in from another app; no screen and no resolver could reach any of it. It has been deleted, along with the two Jira administration scopes that had been declared for it.