Skip to main content
Connect Odin to Bitbucket Cloud to give Mjolnir access to your repositories. Mjolnir reads your source code to map routes, authentication flows and business logic for whitebox pentesting. When you enable PR Reviews, it also posts review feedback on your pull requests and can retest linked findings when a fix is merged.
Odin reads your repository contents for pentesting. For PR Reviews it also posts review comments and a single build status on the pull requests in repositories you enable, and adds a webhook to those repositories. It never pushes code, creates or merges pull requests, or changes your branches.
Bitbucket Cloud (bitbucket.org) is supported. Bitbucket Data Center and Server are not.

​
Connect Bitbucket

Bitbucket authenticates through OAuth 2.0. You authorise Odin with your Bitbucket account, and Odin can then reach the repositories that account can reach, across every workspace it belongs to.
1

Open Integrations

Go to Management > Integrations in the sidebar.
2

Connect Bitbucket

Click Connect next to Bitbucket. You’re sent to Atlassian to review the requested access and click Accept.
3

Pick repositories when you need them

There is nothing else to configure on the integration. You choose repositories when you set up a pentest or switch on PR reviews.
Connect with an account that can see the repositories you want to test. To switch on PR reviews for a repository, that account also needs admin access to it, because Odin adds a repository webhook. A dedicated service account in your workspace works well for this.
You can revoke access at any time from Bitbucket > Personal settings > App authorisations, or by disconnecting the integration in Odin. Disconnecting also removes the webhooks Odin added.

​
Using Bitbucket with Mjolnir

Once Bitbucket is connected, it becomes a source option when you set up a Mjolnir run. On the source step of the Mjolnir setup wizard, pick a repository (grouped by workspace) and the branch Mjolnir reads. When more than one source-control provider is connected, the wizard shows a provider toggle so you can choose which one this run uses. With only Bitbucket connected, the wizard goes straight to the Bitbucket repository picker.

​
PR Reviews

Switch PR reviews on per repository from the PR Reviews page, under PR Reviews · Bitbucket. Odin then:
  1. Adds a signed webhook to the repository for pull request events.
  2. Reviews each new commit on an open pull request and posts findings as inline comments. Findings outside the changed lines are posted as general comments that name the file and line.
  3. Posts an Odin security review build status on the head commit, which fails when findings at or above your blocking severity are found. Add it as a required build in your branch restrictions to block merges.
  4. Keeps one summary comment on the pull request up to date.
Switching PR reviews off for a repository removes the webhook. Pull requests from forks are not reviewed.

​
Linking pull requests to findings and retests

Mention a finding’s identifier (for example ACME-42) in a pull request’s source branch name, title or description, and Odin links the pull request to that finding. A reported finding moves to Fixing when it is linked. Turn on Automatic retests on the Bitbucket integration to have Odin retest linked findings when the pull request is merged. Linking needs the repository webhook, so it works in repositories with PR reviews switched on.

​
Permissions

Odin requests these Bitbucket scopes: Odin never uses repository write access to push code. Access tokens are stored encrypted in Google Secret Manager, last two hours, and are refreshed automatically.

​
Notes

  • Bitbucket is a source-code connection for whitebox pentests, PR reviews and retests. It does not track findings as issues. To sync findings into a tracker, connect Jira, Linear or another tracker alongside Bitbucket.