Bitbucket support went live this week. If your repos live in a Bitbucket Cloud workspace, Xora can now test them end to end: connect, sync, scan, exploit, report.
Connect a Workspace, Get Scans
Connect with OAuth, pick a workspace, and Xora syncs its repos. A webhook keeps the picture current as you push. From there it’s the same path GitHub customers run: clone the source, map the routes, and let the agents try to prove what’s exploitable.
One thing we learned building it: Bitbucket retired its workspace-listing endpoint in April, and the 404 the old route returns looks exactly like a failed login. If you’re building against the API yourself, /2.0/user/workspaces is the one that still exists. That diagnosis cost us an afternoon.
Findings Point Back to Bitbucket
Source links on findings open the Bitbucket file at the vulnerable line. Verify Fix works too: push a fix, and Xora replays the original exploit against your environment to confirm the hole is actually closed.
Leave a Reply