Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Best practices for setting up & securing a BitBucket Mercurial repo


What are the best practices for setting up and for securing all aspects of a BitBucket Mercurial repo (hosted on, including access, ensuring simplified commit histories and branch heads, etc.?

For pushes, can I:

  1. Forbid creating more than one head per branch
  2. Forbid commits from users whose user name does not exactly match a BitBucket account, either matching by email address alone, or also including the full name?  Can I restrict the email address (& possibly full name) to that of the approved BitBucket account at the time when that account was authorized  (i.e., the BitBucket account email address and full name cannot have changed)
  3. Require that all commits are digitally signed, either via the Commitsigs extension, or via some other mechanism
  4. Require that all pushed heads build successfully, pass all tests, and conform to formatting / linting standards
  5. Use the ACL extension to allow / deny access to particular users for particular files
  6. Require that no files that match any .hginore patterns are ever committed

Obviously there are other components of setup & security.  It would be great to compile a comprehensive guide.  Other potential practices include:

  1. requiring two-factor authentication
  2. requiring ed25519 ssh keys
  3. enabling ssh compression
  4. assigning repos to projects within teams



Log in or Sign up to comment

Atlassian Community Events