Get early access

CVE monitoring for code on Bitbucket

Run the mopoke CLI in Bitbucket Pipelines and MopokeHQ re-checks every SBOM you upload whenever a new advisory lands, ranks what is live in production, and keeps the evidence. A native Bitbucket integration is coming.

Get early accessAll platforms

Coming Native Bitbucket integration. Uploads through the CLI work today.

What works today

The mopoke CLI runs as a job in Bitbucket Pipelines and pushes the SBOM out. From there everything that is not Bitbucket-specific already works: matching, priorities, alerts, the roadmap and evidence.

Pass the project, commit and branch with --project, --commit and --ref. A mopoke deploy --env production step after your deploy job tells MopokeHQ what is live.

Upload
mopoke scan in Bitbucket Pipelines
Matching
Every stored SBOM re-checked when an advisory lands
Priority
P1 to P3 from KEV, EPSS, severity and what is live
Deploys
mopoke deploy after each deploy job
Evidence
Hash-chained log, client notices and evidence packs

What the Bitbucket integration adds

The same depth GitLab has now, in Bitbucket’s own terms. Until it ships, these parts are GitLab only.

  • Findings on the pull requestNew findings commented where the code changes
  • A gate on new findings onlyFails on a new critical, a new secret or a new known-exploited dependency
  • Fix pull requestsOpened from your own runner for queued upgrades
  • Deployment eventsWhat is live, without an extra step in each deploy job

Questions

Does MopokeHQ work with Bitbucket today?

Yes, through the CLI. A Bitbucket Pipelines step runs mopoke scan to build and upload the SBOM, and a mopoke deploy step after your deployment reports what is live. Pull request comments, fix pull requests and deployment events come with the native Bitbucket integration.

Does MopokeHQ need access to my Bitbucket workspace?

Not for scanning. The CLI runs in your own pipeline and pushes results out with a token you control. MopokeHQ never connects in.

We are an agency with client repositories on Bitbucket. Does that work?

Yes. Group projects by client in MopokeHQ, whatever platform each repository lives on, and send each client its own notices and evidence.

When is the Bitbucket integration coming?

There is no date yet. Ask for early access, say you are on Bitbucket, and we will let you know when it is ready.

Put a mopoke on night watch

Run the CLI in Bitbucket Pipelines today. Your first SBOM is matched against every advisory we hold within minutes.

Get early accessSee how it works