Skip to content

BitBucket

SailPoint Entro security scans BitBucket repositories to protect your organization from secret targeted attacks and find secrets that are leaked across your commits.

The Bitbucket Integration enables SailPoint Entro to continuously scan repositories and commits across Bitbucket Cloud and Bitbucket Data Center (on-prem) for exposed secrets, credentials, and tokens.

SailPoint Entro connects securely using read-only authentication methods - either a Bitbucket API Token / App Password or a Workload Identity Federation (WIF) token - ensuring zero write or modification actions on your repositories.

Architecture

SailPoint Entro Security Cloud
        ↕  (HTTPS/TLS)
Bitbucket Cloud or Data Center
   ├── Repositories
   ├── Commits
   └── Branches

SailPoint Entro’s integration interacts directly with the Bitbucket API to enumerate repositories, commits, and branches, then performs in-memory secret scanning through its secure cloud engine or local connector.

Security & Compliance

  • All operations are read-only.

  • Source code is never stored — only hashed metadata and secret context.

  • Credentials (App Passwords, API Tokens, or WIF tokens) are encrypted using AES-256.

  • All communications occur via TLS 1.2+.

  • SailPoint Entro complies with:

    • SOC 2 Type II

    • ISO 27001

    • GDPR