Skip to main content

Code Onboarding: GitHub, GitLab, Bitbucket & Azure DevOps

Onboarding a New Source Code Provider​

Cloudanix supports four source-code management providers:

  1. GitHub
  2. Bitbucket
  3. GitLab
  4. Azure DevOps

Getting started:

From your dashboard, click Connect New in the top-right corner to launch the onboarding wizard.

Cloudanix console dashboard with the Connect New button highlighted in the top-right corner

Select the provider you want to connect:

Onboarding wizard listing Cloud, Code and Agentic providers, with GitHub, Bitbucket, GitLab and Azure DevOps under Code

Capabilities you can enable:

During onboarding you select which capabilities to turn on.

  • Events & Threats — Real-time monitoring of activity and configuration changes across your organization (all providers).
  • Misconfiguration Analysis — Flags insecure repository settings such as weak access controls (GitHub only).
  • Secret Scanning — Detects accidentally committed secrets (all providers).
  • SAST — Static analysis of your source code for vulnerabilities (all providers).
  • Software Composition Analysis (SCA) — Dependency and supply-chain risk analysis (all providers).

GitHub onboarding step with toggles for Misconfig, Events & Threats, Secret Scanning, SAST and Software Composition Analysis, each showing its permission level

Authorization:

Each provider is connected using its own native, secure authorization model:

  • GitHub — you install the Cloudanix GitHub App, which operates with scoped, read-only access (shown as cloudanix[bot]).
  • GitLab — OAuth / OpenID Connect.
  • Bitbucket — OAuth.
  • Azure DevOps — OAuth via Microsoft Entra, with a dedicated service principal added to your organization.

The flow is consistent across all four.

Connect to your GitHub Organization step with the Authorize button and a note that only GitHub Organization accounts are supported

What happens after you connect:

Once authorized, Cloudanix begins pulling your organization's inventory — repositories, users, and configurations — and populating the platform.

After the initial inventory completes, a baseline Full Scan of your selected repositories is kicked off automatically. This establishes the initial set of findings across those repositories, giving you a complete security baseline to work from.