Bitbucket Integration

Overview

Argus scans the commit history of every repository in a Bitbucket Cloud workspace for credentials — API keys, tokens, private keys and passwords that were committed and then forgotten. Connecting a workspace is an OAuth flow: you authorise Argus, pick the workspace, and repositories are discovered for you.

Bitbucket Cloud is supported. Bitbucket Data Center and Server, the self-hosted editions, are not.

Prerequisites

• Admin access to the Bitbucket Cloud workspace you want to scan
• A Bitbucket account that can grant the repository and account scopes
• A Cremit Argus account

Step-by-step setup

1. Add the scan source

In Argus, open Scan Sources, choose Add source, and select Bitbucket. Give it a label you will recognise later — the workspace name usually does.

2. Authorise Argus in Bitbucket

Argus sends you to Bitbucket's consent screen and asks for two scopes: repository, to read repository contents and commit history, and account, to read the workspaces you belong to. It asks for nothing that can write to your code.

3. Choose the workspace

After you authorise, Argus lists the workspaces your account can reach. Pick the one to scan. If the list is empty or the workspace you want is missing, type its slug — the part of the URL after bitbucket.org — and Argus will resolve it.

4. The first scan

Argus discovers the repositories in the workspace and queues them. The first pass walks the full commit history, so it takes longer than the ones after it; later scans only look at what has changed.

What Argus scans

• Commit history across the branches of every repository in the workspace
• The file contents at each commit, not just the current HEAD — a secret removed in a later commit is still in history and still valid
• New repositories added to the workspace, picked up on the next discovery pass

What Argus does not do

• It never writes to your repositories. The OAuth scopes it holds are read-only.
• Source code is not stored. Repositories are cloned to a temporary working directory, scanned, and the directory is deleted — including when a scan fails partway.
• Bitbucket Data Center and Server are not supported. Only Bitbucket Cloud.

Troubleshooting

The workspace list is empty

Your Bitbucket account may not be a member of any workspace, or the consent may have been granted to a personal account rather than the team's. Enter the workspace slug directly to check.

Scans stopped and the source shows a connection problem

An OAuth grant can be revoked in Bitbucket, or expire when the authorising user leaves the workspace. Reconnect the source from its detail page; the repositories and findings already discovered are kept.