Group Blast Radius — documentation

For Jira Cloud. Read-only. Free.

The app answers one question: if I change or remove this group, what breaks? It reads your site's configuration and lists every place the group is referenced, so you can look before you cut.

Finding it

After installation the app lives in Jira's administration area: Settings → Apps → Group Blast Radius. It is an admin page, so you need Jira administrator rights to open it. There is nothing to configure and no setup step — install it and it works.

Running a report

1. Open the app and start typing in Choose a group. The search runs against your site, not against a cached page of results, so groups beyond the first screenful are still findable.
2. Pick the group and press Analyse.
3. A progress bar appears while projects are scanned. Larger sites take longer — the project sweep is the slow part, because each project's permission scheme and role membership is checked individually.

Reading the result

A banner at the top summarises the run, then each area reports separately. The status word on each section is the part worth reading carefully. It distinguishes "we looked and found nothing" from "we could not look" — those are very different facts, and most tools show you the same green tick for both.

• N affected — the group is referenced here, and the references are listed.
• clear — this area was read successfully and contains no reference to the group. This is the only status that means safe.
• not checked — this area could not be read on your site. Treat it as unknown, not as clear. The usual cause is that the feature isn't on your Jira plan; issue security schemes, for example, are a paid-tier feature.
• N found — incomplete — the scan hit a limit partway through. What is listed is real, but the list stops short, so something absent may still exist.
• incomplete — there were too many items to scan in one pass. Same caution applies.

If the project scan does not finish, the top banner says so explicitly and tells you not to treat the report as a safety check. It will not show you a clean bill of health it hasn't earned.

What it checks

• Permission schemes — grants held by the group, directly or through a project role.
• Projects — projects reached via those schemes, and projects where the group is a role actor.
• Notification schemes — events that notify the group. These are read one scheme at a time, deliberately; see the note on why.
• Issue security schemes — security levels the group is a member of.
• Shared filters — filters shared with the group.
• Shared dashboards — dashboards shared with the group.

What it does not check

Stated plainly, because a gap you don't know about is worse than one you do. The app does not currently scan:

• Workflow conditions, validators and post-functions
• Automation rules
• Third-party app configuration

If your group is referenced in one of those, this report will not find it. That is a known limit and it is on the roadmap — it is not a failure of the scan.

About the permissions it asks for

At install time Jira will show a scope named manage:jira-configuration. The name is Atlassian's, not ours, and it is the scope that covers reading permission, notification and issue-security schemes. The app only ever issues read requests and contains no code that creates, updates or deletes anything.

We tried to ask for less. Atlassian's granular read-only scopes work for permission schemes and project roles, but read:notification-scheme:jira is rejected on the notification-scheme endpoint the app needs — narrowing would mean silently dropping the whole notification-schemes check. We would rather request a scope that sounds broad and explain it than quietly reduce what the app looks at. If Atlassian fixes that scope, we will switch and say so here.

Your data

Everything runs inside Atlassian's infrastructure on Forge. The app declares no external network access, stores nothing, and cannot transmit your data anywhere. Details in Privacy.

Getting help

Email hello@lintelworks.net — see Support for what's useful to include. If you ever find a report that says clear for something that was in fact referenced, tell us straight away: that is the most serious defect this app can have, and it is treated as such.