Product Overview: Bitbucket Security Scanning
Bitbucket Security Scanning is an integral component of Atlassian’s Bitbucket platform, designed to enhance the security posture of your code repositories by integrating robust security tools and practices into your development lifecycle.
What it Does
Bitbucket Security Scanning aims to identify and mitigate security vulnerabilities within your codebase, ensuring that sensitive information and potential security risks are detected and addressed proactively. This is achieved through integrations with advanced security tools like Soteri and Snyk.
Key Features and Functionality
1. Secret Scanning with Soteri
- The Security for Bitbucket Enhanced Secret Scanner by Soteri detects and blocks commits containing sensitive information such as passwords, API keys, and other secrets. This scanner can run audits on already-committed code and protect Personally Identifiable Information (PII).
- Custom security scanning rules can be configured using regex patterns to address unique use cases, such as finding internal API keys or network credentials.
2. Vulnerability Scanning with Snyk
- The integration with Snyk provides a Security tab in Bitbucket Cloud, where teams can identify vulnerabilities in their dependency files, codebase, and container images. This includes scanning package dependencies and Docker files, and providing a centralized dashboard to view and prioritize vulnerabilities based on a risk score.
- The Snyk Pipe in Bitbucket Pipelines automates security testing within the CI/CD workflow. It scans dependencies for open-source vulnerabilities and can gate the process if high-severity vulnerabilities are found, preventing them from reaching production.
3. Proactive Security
- Both Soteri and Snyk integrations enable proactive security measures. With Soteri, you can scan repositories during pushes and commits, blocking any code that contains sensitive information. Snyk allows teams to identify and fix vulnerabilities during the development phase, rather than after code has been shipped to production.
4. Centralized Dashboard and Reporting
- The security tab powered by Snyk and the Soteri dashboard provide comprehensive visibility into the security posture of your repositories. You can view security insights, vulnerability reports, and export results for further analysis.
5. Customization and Automation
- Users can customize security scanning rules to fit their specific needs. For example, Soteri allows you to create custom scanner rules using regex patterns. Additionally, the Snyk Pipe can be easily integrated into Bitbucket Pipelines by adding a few configuration lines to your
bitbucket-pipelines.ymlfile.
6. Alerts and Notifications
- Features like email notifications upon scan completion and real-time alerts for security-related incidents help ensure that security teams are promptly informed of any vulnerabilities or issues detected.
7. Access Control and Compliance
- The tools support granular access control, allowing you to grant access to settings to additional users and groups. This ensures that security settings are managed according to the least privileged access model, enhancing overall security compliance.
By integrating these advanced security scanning features into Bitbucket, teams can significantly reduce the risk of data breaches, ensure the security of their codebase, and maintain a robust DevSecOps practice.