Connect Safeguard to Bitbucket: public and private repositories

Bitbucket is the SCM provider with the most detailed walkthrough in the Safeguard docs. That makes it a good reference for how any repository connection works. This guide follows the docs closely and adds nothing they do not say.

What it is

A Bitbucket connection tells Safeguard which repositories to scan. Safeguard generates an SBOM for each one, shows the result as a project, and keeps scanning it daily for newly disclosed vulnerabilities.

How to use it: public repository

1. Open Integrations and click Connect on the Bitbucket card.
2. Choose the Public tab. Enter a Name, an optional Description and the public URL.
3. The page validates the URL and shows "Repository URL is valid." Click Add.
4. Check the Added URLs table, then click Next.
5. On the review step, tick the repositories and set Branch/Tag, Project Name and Version. Click Connect.
6. The configuration appears in the Project Configurations table.

How to use it: private repository

1. Click Connect on the Bitbucket card and choose the Private tab.
2. Enter a Name and an optional Description.
3. Enter a Username and an Access Token / App Password, then click Verify Credentials.
4. On success you see "Credentials verified successfully!" Click Next.
5. Pick a Workspace, then configure each repository's branch or tag, project name and version. Click Connect.

The docs do not list which permissions the token or app password needs. Create it under a dedicated account and keep its access to the repositories you actually want scanned.

What you get

Project Name defaults to the repository name and Version defaults to 1.0.0 unless git tags provide one. Generation times in the docs: under a minute for fewer than 100 dependencies, 2 to 5 minutes for 100 to 500, and 5 to 15 minutes above that. The Projects table then shows status, findings by severity and the vulnerability count.

CI note

The CI/CD docs now have a Bitbucket Pipelines guide. Create a secret key in Safeguard under Settings › Developer with the scopes scans:trigger and scans:read, add it in Bitbucket as a secured repository variable named SAFEGUARD_API_KEY, and add a step that installs the Safeguard CLI on an alpine image and runs safeguard ci scan --wait --fail-on critical. No Pipe is needed. The guide shows the full bitbucket-pipelines.yml for pushes to main and for pull requests, and notes that secured variables are not passed to pull requests from forks.

Quick check

Sources

• ESSCM integrations
• CI/CD integration
• Bitbucket Pipelines