Stanki Guild

A quiet workshop in Elbląg

We are a small company in the north of Poland. We build apps for Atlassian Cloud. There are two of them, and we take our time with each.

Stanki Guild sp. z o.o., ul. Adama Mickiewicza 13/4, 82-300 Elbląg

Nothing leaves the valley

Our apps run entirely on Atlassian's Forge platform. They store data only on your own Atlassian site, and there is no path for it to go anywhere else.

Neither app declares external network access, remotes or a web trigger, so there is no outbound path.

We hold no keys

We run no servers, no databases and no hosting of our own. We have no console, no export and no back door into your site. We see your content only if you send it to us in a support request.

No analytics, no telemetry, no third-party API, no sub-processors.

Every step is tested

Before a release, every test must pass. The tests sit where a bug would be a security bug: who may sign, how many must sign, which version was read, and what is deleted on uninstall.

Approval Flow: 187 tests, 187 pass. Attestation Flow: 162 tests, 162 pass. Measured 12 October 2026.

We tried to break it

We go over each new feature as an attacker would, and assume it is broken until a test proves otherwise. Each fix comes with a test that fails without it. Some of what we found was real, and we fixed it before release.

One example: a very large group could have been cut short without warning, so some required readers would never be counted. Now such a group is marked unresolved, and the page is never shown as complete.

Another: a person who applied a policy could then sign off its requirements themselves, even with separation of duties on. Fixed, with a test.

This is our own work, not an external assurance. No independent penetration test has been commissioned.

Measure first, then speak

Every number we publish should come with the command that recomputes it. If a finding turns out to be wrong, we mark it wrong where it stands and leave it there, instead of deleting it quietly.

Two apps, made with care

Both are Atlassian Forge apps, installed from the Atlassian Marketplace, with billing handled by Atlassian.

Confluence

Attestation Flow for Confluence

Attestation Flow lets you require named people, or members of Confluence groups, to confirm that they have read and understood a Confluence page. Each confirmation is a write-once receipt bound to the exact page version. When the page is edited, readers are asked to acknowledge the new version, and earlier receipts stay as history. Compliance reports show who has and has not acknowledged, with due dates and a CSV export for audit. The app has no write access to Confluence content and never reads the page body.

Read the docs

Jira

Approval Flow for Jira

Approval Flow adds required sign-offs to Jira work items and enforces them in your workflow: a validator blocks the transition until every required sign-off is granted. Each sign-off records who approved and when, and your identity is always taken from Jira's trusted context, never from the browser. You can name approvers, require a quorum of distinct approvers, turn on separation of duties, and let a substitute sign on your behalf while you are away, with both names on the receipt. Built for Jira Software and Jira business projects.

Read the docs

Open work: ScannerTruth

We measure security scanners for Solana smart contracts, our own included, against real vulnerabilities taken from their maintainers' own fix commits. The method, the data and every number are public, and anyone can rerun them.

The first tool it measured was our own, and ours scored 0 out of 11 on real recall. We published that too.

github.com

ScannerTruth

An independent, repeatable measurement of Solana security scanners: seven third-party scanners and our own, scored under a mapping fixed before the run. One command runs 171 self-checks with no dependencies, and every published number carries a log of what was analysed. MIT licensed.

View on GitHub

Stanki Guild sp. z o.o.

Stanki Guild sp. z o.o.
ul. Adama Mickiewicza 13/4, 82-300 Elbląg, Poland
KRS 0001264778 · NIP 5783187890