Connect Safeguard to Bitbucket: public and private repositories

Bitbucket is the SCM provider with the most detailed walkthrough in the Safeguard docs. That makes it a good reference for how any repository connection works. This guide follows the docs closely and adds nothing they do not say.

What it is

A Bitbucket connection tells Safeguard which repositories to scan. Safeguard generates an SBOM for each one, shows the result as a project, and keeps scanning it daily for newly disclosed vulnerabilities.

How to use it: public repository

1. Open Integrations and click Connect on the Bitbucket card.
2. Choose the Public tab. Enter a Name, an optional Description and the public URL.
3. The page validates the URL and shows "Repository URL is valid." Click Add.
4. Check the Added URLs table, then click Next.
5. On the review step, tick the repositories and set Branch/Tag, Project Name and Version. Click Connect.
6. The configuration appears in the Project Configurations table.

How to use it: private repository

1. Click Connect on the Bitbucket card and choose the Private tab.
2. Enter a Name and an optional Description.
3. Enter a Username and an Access Token / App Password, then click Verify Credentials.
4. On success you see "Credentials verified successfully!" Click Next.
5. Pick a Workspace, then configure each repository's branch or tag, project name and version. Click Connect.

The docs do not list which permissions the token or app password needs. Create it under a dedicated account and keep its access to the repositories you actually want scanned.

What you get

Project Name defaults to the repository name and Version defaults to 1.0.0 unless git tags provide one. Generation times in the docs: under a minute for fewer than 100 dependencies, 2 to 5 minutes for 100 to 500, and 5 to 15 minutes above that. The Projects table then shows status, findings by severity and the vulnerability count.

CI note

The CI/CD docs give examples for GitHub Actions, GitLab CI, Jenkins and Azure DevOps. Bitbucket Pipelines is not mentioned, so use the same install and safeguard detect commands as a starting point, and test them yourself.

Quick check

Sources

• ESSCM integrations
• CI/CD integration