Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Overview

Secure your code from the inside out, without slowing down delivery. Hopper’s Azure DevOps integration brings precision vulnerability detection and license compliance into your Git workflows using seamless, read-only access. With zero developer friction, Hopper analyzes your repositories at the function level, identifying only exploitable vulnerabilities and high-impact license risks. You also get exportable SBOMs, so your teams stay audit-ready and focused on what matters.

Capabilities

  • Automatically lists all repositories within connected Azure DevOps organizations or projects
  • Performs static analysis using secure, read-only Git access
  • Detects direct and transitive dependencies, including shaded or renamed components
  • Analyzes function-level reachability to determine real exploitability
  • Identifies open-source license violations based on organizational policy
  • Generates SBOMs in SPDX or CycloneDX formats
  • Provides contextual remediation with call graphs, affected functions, and fix effort estimates

Requirements

  • Hopper account
  • Azure DevOps Services

Setup Instructions

  1. Log in to the Hopper platform.
  2. Navigate to Integrations > Azure DevOps.
  3. Provide a Personal Access Token with “All Accessible Organizations” enabled a “code_read” permission

Permissions

Hopper requires only the following permissions:

  • Read access to repository metadata (repository names, branches, project names)
  • Read access to repository content (for static and dependency analysis)

The integration does not:

  • Modify any files or repositories
  • Require write, admin, or pipeline access
  • Access secrets, environments, or CI/CD artifacts

Security and Data Handling

Hopper accesses repositories over HTTPS or SSH using secure authentication. No source code is stored. All analysis is performed in-memory or via ephemeral environments.

  • Hopper does not persist cloned repositories
  • No build or deployment configuration is required
  • Results are encrypted and retained securely for analysis and reporting

Output

  • A list of reachable vulnerabilities with call graph and file/function-level context
  • License inventory with policy violation alerts
  • Exportable SBOMs in SPDX or CycloneDX formats

Support

For troubleshooting or technical questions, contact: support@hopper.security