Skip to content

Bitbucket Client Secret

Service Name: Bitbucket

Service Description: Bitbucket is a Git-based source code repository hosting service owned by Atlassian. It offers both commercial plans and free accounts with an unlimited number of private repositories.

Service Address: https://bitbucket.org/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants access to Bitbucket API resources based on the OAuth application's permissions.

Secret Revokement URL: https://bitbucket.org/account/settings/app-passwords/

Secret Example: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef

Suspicious Activity Investigation Instructions:

  • Review Bitbucket audit logs for unusual repository access or changes
  • Check for unauthorized OAuth applications connected to your Bitbucket account
  • Monitor for unexpected repository collaborators or access changes
  • Review recent API calls made using the client credentials

Mitigation Instructions:

  • Log in to your Bitbucket account
  • Navigate to Bitbucket settings > OAuth
  • Find the affected OAuth consumer application
  • Click "Delete" to revoke the client secret
  • Create a new OAuth consumer with fresh credentials
  • Update any legitimate applications with the new credentials