Security Risk? Bitbucket integration with Vanta

Question

Hi All,

We are working with a vendor on a compliance project. One of their tools integrates with Bitbucket and checks for misconfigured settings/etc. I was wondering if anyone has come across this and could offer some advice as far as security risks regarding the integration? We obviously don't want to make something more secure by opening up another hole :)

From their website:

Overview
Automates the collection of evidence for your code repository configurations, pull request workflows, and security issue tracking.

Automation
Automates 11 tests and 7 controls

Permissions
Vanta requires read-only access to your account information, team membership, repositories, issues, pull requests.

We also request permission to administer your repositories to check branch protection. There is currently no read-only access for this.

Any insights are helpful. Thank you!

Toan Duong_xwtc7i · Answer

Yes, we are aware that they will have access to more critical systems. As far as Bitbucket goes, do you know if their integration actually has access to the code files?

Toan Duong_xwtc7i · Answer

Yep. We are trying to assess pros/cons of this integration. Thank you for your input.

Aron Gombas _Midori_ · Answer

We are using Vanta and allowed them to access our Bitbucket Cloud workspace. It is obviously a security risk, but as @marc -Collabello--Phase Locked- noted these tools need access to check for misconfigured settings and such. We just accepted it and trust them.

Note that Vanta will ask for access to a lot of other possibly even more critical systems in your infrastructure, not only e.g. Jira Cloud, but even on the PaaS level (AWS)!