Exposure Audit for Confluence
A read-only audit that shows what on your Confluence Cloud site is too open. It runs entirely on Atlassian's platform; nothing leaves Atlassian.
How to use it
- Install the app from the Atlassian Marketplace.
- Open Confluence settings → Apps → Exposure audit (Confluence admins only).
- Click Run scan. Small sites finish in seconds; large sites scan in the background and you can leave the page.
- Review the findings, then use Show CSV or Show evidence export for your records.
What each finding means
| Finding | Severity | What it means |
|---|---|---|
| Anonymous access | High | Anyone on the internet can view the space (when anonymous access is on for the site). |
| Broad group: control | High | All users can administer the space, delete it, manage its users or manage public links. |
| Broad group: content changes | Medium | All users can create, edit, delete, archive or restrict content. This is Confluence's default for new spaces; decide whether it fits each space. |
| Broad group: view only | Low | All users can view, comment or export. |
| Guest | Medium | A guest (external) account is named in space permissions or page restrictions. |
| Inactive account | Medium | A deactivated or closed account is still named in permissions or restrictions. |
| Edit restriction gap | Low | A page anyone can edit sits under a parent page whose editing is restricted. Edit restrictions do not carry down to child pages in Confluence. |
What is not checked
- Public links: Atlassian provides no API for them. Review them in Confluence admin → Global permissions → Public links.
- Content the app cannot see: spaces and pages restricted so that apps cannot read them are listed as not inspected. They are never reported as safe.
Every report has a Coverage section that states exactly what was and was not read.
Permissions the app requests
Read-only access to spaces, space permissions, pages, page restrictions, users and groups, plus app storage for the latest report. The app has no write permissions and no outside network access.
Published by Intropi.