Community
Q&A
Bitbucket
Questions
Security Risk? Bitbucket integration with Vanta

Security Risk? Bitbucket integration with Vanta

Hi All,

We are working with a vendor on a compliance project. One of their tools integrates with Bitbucket and checks for misconfigured settings/etc. I was wondering if anyone has come across this and could offer some advice as far as security risks regarding the integration? We obviously don't want to make something more secure by opening up another hole :)

From their website:

Overview
Automates the collection of evidence for your code repository configurations, pull request workflows, and security issue tracking.

Automation
Automates 11 tests and 7 controls

Permissions
Vanta requires read-only access to your account information, team membership, repositories, issues, pull requests.

We also request permission to administer your repositories to check branch protection. There is currently no read-only access for this.

Any insights are helpful. Thank you!

2 answers

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

1 vote

We are using Vanta and allowed them to access our Bitbucket Cloud workspace. It is obviously a security risk, but as @marc -Collabello--Phase Locked- noted these tools need access to check for misconfigured settings and such. We just accepted it and trust them.

Note that Vanta will ask for access to a lot of other possibly even more critical systems in your infrastructure, not only e.g. Jira Cloud, but even on the PaaS level (AWS)!

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Yes, we are aware that they will have access to more critical systems. As far as Bitbucket goes, do you know if their integration actually has access to the code files?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

0 votes

Obviously adding Vanta is an additional security risk. However maybe Vanta catches other security risks and implements required audit controls. This might be a net positive.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Yep. We are trying to assess pros/cons of this integration. Thank you for your input.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Was this helpful?

Thanks!

Bitbucket

DEPLOYMENT TYPE

CLOUD

Forums

Q&A

Community resources

Support

Top groups

Community resources

Support

Learn

Community resources

Support

Events

Community resources

Support

Security Risk? Bitbucket integration with Vanta

2 answers

Comments for this post are closed

Was this helpful?

Thanks!

DEPLOYMENT TYPE

TAGS

Atlassian Community Events