Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt

Use this file to discover all available pages before exploring further.

Endor Labs provides a Bitbucket App that continuously monitors users’ projects for security and operational risks in Bitbucket Data Center. You can use the Bitbucket App to selectively scan your repositories for SCA, secrets, and SAST. When you use the Endor Labs Bitbucket App, it creates namespaces based on your projects in Bitbucket Data Center. The namespaces created by the Endor Labs Bitbucket App are managed namespaces and not regular namespaces. You can either configure the URL to Bitbucket Data Center to import all the projects or configure the project key to import a specific project in Endor Labs.
You can use the following characters in Endor Labs namespaces: lowercase letters (a–z), digits (0–9), hyphens (-), and underscores (_). Additionally, the namespace can have a maximum of 64 characters. If the Bitbucket host or your projects have a different naming convention, Endor Labs converts the corresponding namespaces to comply with the naming convention.
See Manage Bitbucket Data Center App to learn how to manage your Bitbucket Data Center App integration in Endor Labs.

​
Managed namespaces for Bitbucket Data Center

You need to add the Bitbucket Data Center host or a project to an Endor Labs namespace. Endor Labs maps the Bitbucket host and projects as managed namespaces. Managed namespaces have the following restrictions:
  • You cannot delete managed namespaces.
  • You cannot delete repositories within managed namespaces.
  • You cannot add projects or create namespaces within managed namespaces.
  • You cannot create new Endor Labs App installations within managed namespaces.

​
Namespace structure when you add a Bitbucket Data Center host

When you add a Bitbucket Data Center host to an Endor Labs namespace, Endor Labs creates a child namespace for the Bitbucket host and creates child namespaces for each project in the host under the host namespace. The namespaces of the host and projects are managed namespaces. If there are periods (.) in the Bitbucket Data Center hostname, it is converted to a hyphen (-). You can add multiple Bitbucket Data Center hosts to the same Endor Labs namespace. Each host will have its own managed namespace. If your host name is bitbucket.deerinc.com and you have three projects, buck, doe, and fawn, Endor Labs creates four managed namespaces: bitbucket-deerinc-com, buck, doe, and fawn. The namespaces buck, doe, and fawn are child namespaces of the bitbucket-deerinc-com namespace. The following image shows the namespace structure in Endor Labs.

​
Namespace structure when you add a Bitbucket Data Center project

When you add a Bitbucket Data Center project to an Endor Labs namespace, Endor Labs creates a child namespace for the Bitbucket Data Center project and maps all repositories in that project to this namespace. The child namespace that maps to the Bitbucket Data Center project is a managed namespace. The managed namespace has the name, <host name>_<project name>. For example, if your Bitbucket hostname is bitbucket.deerinc.com and project name is doe, the managed namespace will have the name, bitbucket-deerinc-com_doe. You can add multiple projects to the same Endor Labs namespace. Each project will have its own managed namespace. For example, your hostname is bitbucket.deerinc.com, which has three projects, buck, doe, and fawn. You add each project to the Endor Labs namespace, endor-bitbucket. The following image shows the namespace structure in Endor Labs.

​
Default branch detection

When Endor Labs scans a repository for the first time, it detects the default branch of the repository. The findings that are created in the scan are associated with the default branch.

​
Changing the default branch

When you change the default branch in your source control system (for example, from main to dev):
  • Endor Labs automatically detects the new default branch and sets that as the default reference
  • The previous default branch becomes a reference branch
  • Scans continue on the new default branch and the reference branch
The findings associated with the previous default branch are no longer associated with the default context reference. You can view them in the reference context.

​
Renaming the default branch

When you rename the default branch in your source control system:
  • Endor Labs automatically switches to the renamed branch
  • Scans continue without disruption

​
Adding repository versions

When you add a new repository version (for example, a dev branch), both the default branch and the new version are scanned by the Endor Labs App.

​
Control default branch detection

You can control the default branch detection by setting the ENDOR_SCAN_TRACK_DEFAULT_BRANCH environment variable in a scan profile. You need to configure the project to use the scan profile. See Configure scan profiles for more information. By default, the environment variable is set to true. When set to true, the default branch detection is enabled, and the first branch you scan is automatically considered as the default branch.

​
Prerequisites for Bitbucket Data Center App

Ensure the following prerequisites are in place before you install the Endor Labs Bitbucket App.
  • A publicly accessible Bitbucket Data Center host set up with HTTPS.
  • A Bitbucket HTTP access token with at least Project read permission at the project level.
  • If your Bitbucket Data Center instance is self-hosted behind a firewall with ingress restrictions, you must configure your firewall to allow inbound connections from Endor Labs. See Firewall & Proxy Rules for detailed guidance on configuring firewall access.
Admin Authorization RoleOnly users with admin authorization role in Endor Labs can create and manage installations. See Authorization roles for more information.

​
Install the Bitbucket Data Center App

  1. Select Projects from the left sidebar.
  2. Click Add Project.
  3. Under Namespace, select the Endor Labs namespace for this installation.
    We recommend you use a child namespace for better organization of your projects.
  4. Select Bitbucket on the Scan your repositories page.
  5. Select Bitbucket Data Center. Bitbucket Data Center
  6. Enter the Bitbucket hostname URL.
    • To import all the projects, provide the base Bitbucket Data Center URL in the format https://<hostname>.
    • To import a specific project, provide the project URL in the format https://<bitbucket-hostname>/projects/{project-key}. For example, https://bitbucket.company.com/projects/LAB.
    Endor Labs creates namespaces for all projects that are available in the Bitbucket Data Center host.
  7. Enter the Bitbucket Data Center HTTP access token.
    Permissions for the HTTP access tokenThe HTTP access token must have at least the read permission for Projects.If you want to scan pull requests, the HTTP access token must have at least write permission for Repositories and read permission for Projects. For more information, see Create an HTTP access token.
  8. Click Create Bitbucket Data Center Installation.
  9. Select the scan types to enable in Scanners.
    • SCA: Perform software composition analysis and discover AI models used in your repository.
    • Secret: Scan Bitbucket projects for exposed secrets.
    • SAST: Scan Bitbucket projects to generate SAST findings.
    The available scan types depend upon your license. Bitbucket Data Center Scanners options
  10. Select Include Archived Repositories to scan your archived repositories.
By default, the Bitbucket archived repositories aren’t scanned.
  1. Optionally, you can continue to Configure Bitbucket Data Center App PR scans to scan your pull requests. Configure a scan profile to apply PR scans for specific repositories rather than all repositories in your Bitbucket project. See Configure PR scans for specific repositories for more information. You can also enable PR scans later in the Bitbucket Data Center App integration.
  2. Click Start Scanning Repositories.
Endor Labs Bitbucket Data Center App scans your Bitbucket projects every 24 hours and reports any new findings or changes to release versions of your code.