
Forge egress: backend ignores your URL path, client enforces it
The same URL in two Forge permission lists means two different things. I read the shipped matcher, deployed a probe to a live site, and measured which half of the docs is wrong.
Step-by-step AI & Atlassian guides with real code examples.

The native HTML export flattens your page tree and renames every attachment to its ID. Here is what the zip actually contains, how to trigger it without a browser, and a v2 API script that rebuilds the tree — including the two bugs that silently ate a page in my first version.

One unused frontend import in a shared file takes a Forge function from HTTP 200 to HTTP 424. It throws at import time, the stack trace blames the wrong function, forge lint says No issues found, and the error message changed in April so the threads you'll find on Google no longer match.

A Community Champion added sendNotifications: false to an automation rule, re-imported it cleanly, and still got the mail. Here is why the flag is ignored, which endpoints actually carry a suppression flag, and how to tell a real API parameter from one Jira is only pretending to accept.

Connect had entity_property_contains_any_user_group. Forge has no such named condition — but it can do the same job with a jiraExpression over your app's own properties. Here is the working manifest, the endpoint that actually exists, and the one-character bug that hides your module everywhere.

An agent scheduled with launchd wrote 288 healthy log lines a day and produced nothing. Here are the eight failure modes behind that, each of which looks identical from the outside, and the checks that make them loud.

A working migration: find what is still using an app password when Bitbucket gives you no report, pick the right credential for each consumer, prove the new token works before you cut over, and purge the cached credential that silently keeps sending the old one.

Running SAST and SCA on a Forge app is easy. The hard part is that your scanner and the reviewer's will disagree about the same version, and if you don't explain why first, your report loses.

Your Forge app's unit tests pass and it still breaks inside Jira. Here's how I drive a deployed Custom UI app in a real browser with Playwright — past the iframe and past Atlassian's 2FA.