JR DevTools
Security
The extensions are built so that your code and work items never reach us. They run in your browser, inside Azure DevOps, as the signed-in user. There is no server of ours in between.
Architecture in short
- Runs in your browser. Azure DevOps loads the extension in a separate frame on its own pages. All work happens there: reading conflicts, merging, editing and validating work items, creating Excel files.
- Talks to your organization only. The extension calls your organization's Azure DevOps REST API with the token Azure DevOps gives it for the signed-in user. We never see or store that token.
- One external call: the license check. About once a week, and when a key is activated, the
extension calls the Lemon Squeezy License API (
api.lemonsqueezy.com) with the license key and an instance name made of your organization name and ID. No code, file names or work item data is sent. - No analytics, telemetry or third-party scripts. No tracking, no error reporting service, no fonts or libraries loaded from a CDN. Everything ships inside the extension package.
Permissions
| Extension | Scope | Why |
|---|---|---|
| Merge Conflict Resolver | Code (read and write)vso.code_write | Read the conflicting files, save resolutions to the pull request and, with Pro, commit the resolution to the source branch and post a summary comment. |
| Bulk Editor | Work items (read and write)vso.work_write | Read the work items you open and save the changes you publish. No access to code, builds or pipelines. |
Both extensions act as the signed-in user and can't do more than that user is allowed to. Branch policies, area path permissions, field rules and state transitions are enforced by Azure DevOps itself, and every change shows up in the normal history under that user's name.
Where data is stored
| What | Where |
|---|---|
| Unsaved drafts | The user's browser (local storage), until resolved, published or discarded |
| License record, trial date, free-plan counters | Extension data storage inside your own Azure DevOps organization; removed when the extension is uninstalled |
| Your code and work items | Stay in Azure DevOps; we never receive them |
| Purchase details (name, email, company) | Lemon Squeezy, our Merchant of Record, and our order records |
The full list is in the privacy policy.
Check it yourself
You don't have to take our word for it. Open the extension, press F12, go to the Network tab
and use it as usual: you'll see requests to dev.azure.com (your organization) and, at most once a
week, one to api.lemonsqueezy.com. Nothing else.
What we don't have
JR DevTools is a one-person company, so there is no SOC 2 report, ISO 27001 certificate or external penetration test. The design is meant to make that matter less: there is no service of ours that stores or processes your data, so there is nothing of yours for us to lose.
Reporting a vulnerability
Email support@jr-devtools.com with "Security" in the subject. Include the extension, its version and steps to reproduce. You'll get a reply within 2 business days, and confirmed issues are fixed with the highest priority. Please give us a reasonable time to ship a fix before you publish details. We won't take legal action against good-faith research that stays within your own organization and doesn't touch other people's data.
Machine-readable contact: /.well-known/security.txt.