Bitbucket
Connect Bitbucket to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Bitbucket to collect version control evidence automatically.
| Category | Version Control |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
- On Compliance › Connectors, open Bitbucket, click Connect and choose OAuth.
- Sign in to Bitbucket and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
repository,account. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Bitbucket:
- In Bitbucket Cloud, select your profile, then Account settings.
- Open the Security tab and select Create and manage API tokens.
- Select Create API token with scopes, give it a name and expiry, and select the Bitbucket app.
- Choose the read-only scopes read:user:bitbucket, read:workspace:bitbucket and read:repository:bitbucket.
- Review, then select Create token and copy it; it is shown only once.
Where to find the other values:
- Bitbucket username: Not located in the fetched docs.
- Workspace: Not located in the fetched docs.
Bitbucket shows the secret only once, so copy it before you leave the page.
Bitbucket's public documentation does not cover every step.
Source: support.atlassian.com, support.atlassian.com, support.atlassian.com, checked 2026-10-07.
-
On Compliance › Connectors, open Bitbucket, click Connect, choose API token and fill in:
Field What to enter Bitbucket username Required. Your Bitbucket account username, not your email address. App password Required. Create under Personal settings → App passwords with read-only Account, Workspace membership and Repository scopes. Stored encrypted and never shown again. Workspace Optional. Leave blank to use the first workspace the credential can see. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Bitbucket and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC2.1, CC6.1, CC6.2, CC6.3, CC7.1, CC8.1 | 18 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.15, A.5.16, A.5.18, A.6.5, A.8.2, A.8.4, A.8.5, A.8.8, A.8.12, A.8.25, A.8.28, A.8.29, A.8.32 | 18 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(c)(1), 164.312(d) | 18 |
| PCI DSS | Automated tests | 6.2.4, 6.3.1, 6.3.2, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2 | 18 |
| NIST CSF 2.0 | Automated tests | ID.AM-02, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.PS-01, PR.PS-06 | 18 |
These tests are switched on per workspace by the Safeguard team.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks