---
title: "Security inquiry: use of BootCDN in Issue Matrix for Jira"
canonical: "https://support.appfire.com/space/SUPPORT/3412231411/Security%20inquiry%3A%20use%20of%20BootCDN%20in%20Issue%20Matrix%20for%20Jira"
format: markdown
---
## Summary

This article addresses security concerns regarding the potential use of the BootCDN service or references to [https://bootcdn.net](https://bootcdn.net) within the Issue Matrix for Jira application. Following a thorough investigation of the source code and dependencies for multiple versions, it has been confirmed that BootCDN is not utilized.

## Use case: security audit for BootCDN usage

Customers may require confirmation of whether the BootCDN service is used within the application due to security concerns, such as reports of malicious JavaScript injection associated with certain Chinese CDNs.

### Investigation details

A comprehensive audit was performed for the following versions of Issue Matrix for Jira:

- Version 4.0.7
- Version 6.1.3-jira9-10

The investigation included:

1. **Source code search**: A full recursive search (`grep`) across the codebase for the string `bootcdn`.
2. **Dependency audit**: Review of POM files, lockfiles, and dependency declarations for any direct or indirect (transitive) references to BootCDN.
3. **Build configuration**: Checking for `.npmrc` files or other build configurations that might redirect installs to BootCDN.

### Findings

- No matches for BootCDN were found in the source code of either version.
- The string `https://bootcdn.net` does not appear in the codebase.
- There are no references to BootCDN in POM files, npm lockfiles, or any other dependency management files.
- No build configurations, such as `.npmrc`, exist that would redirect artifact downloads to BootCDN.

### Conclusion

BootCDN is not used directly or indirectly in the Issue Matrix for Jira plugin. It is not present in the source code, dependency declarations, or build configurations.

> **Note:** This assessment covers the source code and standard dependency manifests. It does not include a cryptographic audit of the internal contents of every third-party downloaded artifact, for example, minified vendor code inside `.tgz` or JAR files, as per standard compliance check practices.