TechPrufer
Get started
Atlassian
Atlassian logoAtlassian · Feature trail

Bitbucket Cloud Security Scanning Integration

5 posts · Nov 2019 – Dec 2021

What this trail covers

Bitbucket Cloud integrates with Snyk to provide automated security scanning of code and dependencies, helping users identify and remediate vulnerabilities like Log4Shell. This capability extends to various security aspects, including vulnerability detection and remediation workflows, and can be integrated into CI/CD pipelines. The integration includes a new security tab for repository-level vulnerability visibility, PR scanning within Code Insights, and a Snyk Pipe for Bitbucket Pipelines. This post introduces Snyk's Auto Upgrade feature, which automatically creates pull requests to update outdated npm and Maven-central dependencies, listing remediated vulnerabilities and ensuring no new vulnerabilities are introduced.

All Atlassian trails
  1. Log4Shell fix with the Bitbucket Cloud and Snyk integrationThis post introduces the integration of Snyk into Bitbucket Cloud, enabling automated scanning of code and dependencies for security vulnerabilities. It specifically highlights the remediation of the Log4Shell vulnerability (CVE-2021-44228) by guiding users to update Log4j to version 2.16.0 or later. The integration allows users to enable Snyk scans via their Bitbucket administrator and view alerts in the repository's security tab.
  2. How to integrate security checks into your deployment workflowThis post details the integration of Bitbucket Cloud with Snyk for automated security scanning. It explains how to enable the native Snyk integration within Bitbucket repositories and how to add a Snyk step to `bitbucket-pipelines.yml` for automated scanning on every commit. Examples are provided for Golang and Python projects, demonstrating the configuration and execution of `snyk test` within pipelines. The post also highlights the benefits of this integration for DevSecOps practices.
  3. Integrate security into development with Snyk, now a seamless part of Bitbucket CloudThis post announces the integration of Snyk into Bitbucket Cloud, focusing on three key areas: a new security tab for proactive repo scanning of dependencies and container images, integration with Code Insights for scanning pull requests, and the introduction of a Snyk Pipe for Bitbucket Pipelines to bring security testing to CI/CD workflows. It highlights the benefits of early vulnerability detection and remediation within the development lifecycle.
  4. 5 tips to keep your code secureThis post provides practical tips for improving code security within Bitbucket deployments, focusing on preventing sensitive data exposure and integrating security into CI/CD pipelines. It details specific tools and practices such as using git-secrets, Vault, Keycloak, GitRob, truffleHog for credential management and auditing, removing sensitive data from history, enforcing 2FA, securing devices, managing access, and utilizing branch permissions. It also introduces the SECURITY.md file for disclosure and update policies. The post highlights the Snyk integration for automated vulnerability scanning within pull requests, showing inline annotations for identified issues and the creation of fix pull requests.
  5. Keep your dependencies up-to-date with Snyk auto upgrade for Bitbucket CloudThis post introduces Snyk's Auto Upgrade feature for Bitbucket Cloud, which automatically creates pull requests to update outdated npm and Maven-central dependencies. It highlights that these PRs will list any vulnerabilities remediated as part of the upgrade and will not introduce new vulnerabilities. The post also reiterates the existing Snyk for Bitbucket Cloud integration for scanning PRs, preventing merges with vulnerabilities, and monitoring repositories.