Overview
Secure your code from the inside out, without slowing down delivery. Hopper’s Azure DevOps integration brings precision vulnerability detection and license compliance into your Git workflows using seamless, read-only access. With zero developer friction, Hopper analyzes your repositories at the function level, identifying only exploitable vulnerabilities and high-impact license risks. You also get exportable SBOMs, so your teams stay audit-ready and focused on what matters.
Capabilities
- Automatically lists all repositories within connected Azure DevOps organizations or projects
- Performs static analysis using secure, read-only Git access
- Detects direct and transitive dependencies, including shaded or renamed components
- Analyzes function-level reachability to determine real exploitability
- Identifies open-source license violations based on organizational policy
- Generates SBOMs in SPDX or CycloneDX formats
- Provides contextual remediation with call graphs, affected functions, and fix effort estimates
Requirements
- Hopper account
- Azure DevOps Services
Setup Instructions
- Log in to the Hopper platform.
- Navigate to Integrations > Azure DevOps.
- Provide a Personal Access Token with “All Accessible Organizations” enabled a “code_read” permission
Permissions
Hopper requires only the following permissions:
- Read access to repository metadata (repository names, branches, project names)
- Read access to repository content (for static and dependency analysis)
The integration does not:
- Modify any files or repositories
- Require write, admin, or pipeline access
- Access secrets, environments, or CI/CD artifacts
Security and Data Handling
Hopper accesses repositories over HTTPS or SSH using secure authentication. No source code is stored. All analysis is performed in-memory or via ephemeral environments.
- Hopper does not persist cloned repositories
- No build or deployment configuration is required
- Results are encrypted and retained securely for analysis and reporting
Output
- A list of reachable vulnerabilities with call graph and file/function-level context
- License inventory with policy violation alerts
- Exportable SBOMs in SPDX or CycloneDX formats
Support
For troubleshooting or technical questions, contact: support@hopper.security