Bitbucket Free & Standard: PR Scans Setup

Configure Bitbucket pull request scanning to publish scan results and comments for issues from Aikido. No pipeline code needed.

This setup is meant for Bitbucket Free and Standard plans, where Workspace Access Tokens aren’t available and a dedicated user is used instead.

If you’re on Bitbucket Premium, use a Workspace Access Token instead of a user-based setup.

Set up Bitbucket PR Scanning

Create a dedicated Bitbucket user

Create a dedicated user like AikidoSec. Use it only for Aikido.

Give this user admin access on the repositories you want to gate. Aikido needs it to create and manage repository webhooks.

Enable the integration

In Aikido, open the Integrations page. Then select Bitbucket under PR Quality Gating.

Grant access

You’ll be redirected to Bitbucket. Approve the requested access.

Configure your first repository

After authorization, Aikido opens the Bitbucket PR Checks page.

Start with one repository first. Confirm everything works before rolling out broadly.

Verify with a new PR

Open a new PR in the repo you configured. Then confirm the checks run.

Comments should appear as the user you created in step 1 (for example, AikidoSec).

Enable for all repositories

Once you’re happy with the results, go back to the Bitbucket PR Checks page and enable checks for the rest of your repositories.

Set the default for new repositories

In the top-right, open Actions and select Set Default for New Repos and enable automatic configuration for newly added repositories in the future.

Need the UI walkthrough? See Default PR/MR gating configuration for new repositories.

On Bitbucket Free and Standard, you can’t require the Aikido scan to be successful to prevent merges. This requires Bitbucket Premium.

See Atlassian: Suggest or require checks before a merge.

Last updated 2 months ago

Was this helpful?