Overview

Cut through the noise and secure your Bitbucket codebase with Hopper. Our integration connects directly to Bitbucket Server or Data Center via read-only Git access, delivering deep static analysis and function-level reachability insights, without agents or pipeline changes. Hopper flags only real risks, filters out false positives, and enriches your security posture with license policy enforcement and exportable SBOMs.
It supports both the Bitbucket server and data center with zero disruption to existing workflows.

Capabilities

• Automatically lists all repositories in the connected Bitbucket workspace.
• Uses secure, read-only Git access to clone repositories without agents or CI/CD changes
• Performs static code analysis using read-only Git access.
• Detects direct and transitive dependencies, including shaded and repackaged libraries.
• Analyzes reachability at the function level to determine actual exploitability.
• Detects license violations and generates complete SBOMs in SPDX or CycloneDX format.

Requirements

• Hopper account
• Bitbucket Cloud
• Permission to install a Bitbucket Cloud app

Setup Instructions

1. Log in to the Hopper platform.
2. Navigate to Integrations > Bitbucket and click “Connect”.
3. Log in to your Bitbucket account (if you aren’t logged in already).
4. Select your Bitbucket workspace and click  “Grant access”.
5. Hopper will begin analysis automatically. No build or pipeline configuration is needed.

Permissions

Hopper requires only the following permissions:

• Read access to repository metadata (e.g., names, branches)
• Read access to file content for static analysis

The integration does not:

• Modify repositories or files
• Access deployment environments
• Require write or admin access

Security and Data Handling

Hopper accesses repositories over HTTPS using secure authentication methods. No source code is stored. All analysis is performed in memory or via ephemeral access.

Output

• List of reachable vulnerabilities with call graph and file/function context
• License inventory and license violation alerts
• Exportable SBOMs in SPDX or CycloneDX formats

Support

For troubleshooting or technical questions, contact: support@hopper.security

‍

Bitbucket Blog Announcement (Hopper Website)

The Hopper Bitbucket App: Secure Your Open-Source Dependencies with Function-Level Precision

Simplifying Open-Source Security in Bitbucket with Hopper

Open-source software powers modern development, but it also introduces security and compliance risks that traditional tools struggle to manage. At Hopper, we're redefining open-source security by focusing on what actually matters: exploitable vulnerabilities. Our new Bitbucket Server integration brings this precision to your workflow without adding overhead.

Why Traditional SCA Falls Short

Security teams often drown in alerts from software composition analysis (SCA) tools. These alerts are frequently false positives, with little to no context for developers. Hopper changes that by performing function-level reachability analysis—determining if a vulnerability is truly exploitable in your code.

What Hopper for Bitbucket Server Offers

Hopper's Bitbucket integration allows you to:

• Detect Reachable Vulnerabilities: Our engine analyzes your code paths down to the function level, surfacing only the vulnerabilities that are actually reachable.
• Avoid Friction: Hopper connects via read-only Git access—no agents, no DevOps changes, and no CI/CD integration required.
• Automatically Discover Assets: Repositories are detected and scanned automatically without configuration.
• Ensure License Compliance: Detect license violations and generate SBOMs (Software Bill of Materials) in standard formats.
• Support Developers with Actionable Guidance: Each finding includes call graphs, file-level context, and fix effort estimates.

How It Works

1. Connect Hopper to Bitbucket Server
   Provide the server URL and authentication token (read-only).
2. Automatic Repository Listing
   Hopper identifies and lists repositories in the workspace for analysis.
3. Perform Static Analysis
   Hopper scans both direct and transitive dependencies, including shaded libraries.
4. Surface Actionable Results
   Findings are prioritized by reachability and presented with technical context to speed up remediation.

Designed with Simplicity and Security in Mind

Your developers and security teams don’t need to worry about complex configurations or excessive permissions. Hopper:

• Requires only read access to your Bitbucket repositories
• Does not modify any files or repositories
• Does not require admin or write permissions
• Performs analysis without storing your source code

Output You Can Use

• A list of reachable vulnerabilities with file/function call graphs
• License violations with package-level details
• Exportable SBOMs in SPDX or CycloneDX

Getting Started

1. Log in to Hopper at https://www.hopper.security
2. Go to Integrations > Bitbucket Server
3. Provide the server URL and your read-only token
4. Let Hopper auto-discover your repositories and begin analysis

Secure Code. Zero Friction.

The Hopper Bitbucket Server integration makes it easy to secure your codebase while eliminating unnecessary noise. With function-level insights and developer-friendly remediation, your teams can move faster, with confidence.

To learn more or schedule a demo, contact us at sales@hopper.security or visit https://www.hopper.security/docs/integrations/bitbucket.

‍