Jira Integration

What does the Jira source read?

The current Cremit connection form accepts a Jira Cloud site name, account email and API token and builds a *.atlassian.net URL. It does not provide a Jira Data Center connection choice. Cremit discovers projects visible to that account; you enable the projects to scan. A project in the list is not proof that its issues were read.

For enabled projects, the worker reads issue summaries, descriptions and comments returned by the Jira issue search response. It also attempts to read supported attachments when they are available. Attachments can be skipped because of permissions, download failures, file rules, size or format limits. The current form has no separate Include Attachments or Include Sub-tasks switch. A clean result covers only content the job actually read.

Connect and select projects

In Cremit Platform, open Configuration → Scan Sources, add Jira, and enter the Cloud site name, account email and API token. Use an account allowed to browse the intended projects and issues. After connection, check the discovered project targets and enable the ones you want scanned. If a project is absent, review Jira permissions and refresh discovery.

Check the first scan

Look at the target status, latest completed job and any skipped or failed issues and attachments. A large project can take multiple jobs; editing an issue does not guarantee a result within a fixed number of minutes. For a safe test, put a nonworking example string in an issue you can access, then verify its location after a completed scan. Do not paste a real key as a test.

For a real finding, record the issue location without copying the secret into another ticket. Check supported issuer evidence and identify the current service owner. The owner rotates or revokes a confirmed exposed credential at the issuer; deleting the Jira text alone does not disable it.

Primary documentation

Jira Cloud issue search API

Jira Cloud attachment access

Atlassian API tokens

Cremit scanning scope