​
Overview

The Bitbucket integration monitors your workspace repositories, branch restrictions, member access, and pipeline configurations. LowerPlane uses read-only access and does not access source code contents.

​
Authentication

Bitbucket uses OAuth 2.0 for authentication. When you connect, you’ll be redirected to Bitbucket to authorize LowerPlane.

​
Required Permissions (OAuth Scopes)

The repository:admin scope is intentionally excluded. LowerPlane does not need administrative access to your repositories. The repository scope provides read-only metadata access.

​
What LowerPlane Collects

Repository Metadata

Name, visibility, language, default branch, open PR count

Branch Restrictions

Required approvals, push restrictions, force push prevention

Workspace Members

Member list for access reviews and offboarding checks

Pipeline Status

Pipeline enablement and build status for CI/CD compliance

​
Security Tests

LowerPlane runs 8 tests against your Bitbucket workspace:

​
MFA Tests (Manual Evidence Required)

Bitbucket’s public API does not expose per-user 2FA status or workspace-level two-step verification policy. The MFA tests are configured as manual evidence-upload tests.
1

Open Atlassian Admin Console

Go to admin.atlassian.com and select your organization.
2

Navigate to Security

Click Security in the left sidebar, then Two-step verification.
3

Take a Screenshot

Capture a screenshot showing the 2SV report for all workspace members, or the authentication policy requiring 2SV.
4

Upload Evidence

In LowerPlane, open the MFA test and upload the screenshot as evidence.

​
Connecting

1

Navigate to Integrations

Go to Settings > Integrations and find Bitbucket in the Developer Tools category.
2

Click Connect

Click the Connect button. You’ll be redirected to Bitbucket’s authorization page.
3

Authorize

Review the requested permissions and click Grant access.
4

Initial Sync

LowerPlane syncs your workspace repositories, members, and branch restrictions. This typically takes 1-2 minutes.

​
Where to Find the App

After connecting, you can find the LowerPlane app in Bitbucket:

​
Pull Request Reviews & Status Checks

LowerPlane collects approver names on pull requests and build status results to verify that peer review and CI/CD gates are enforced before merging. This data is used by the “Code changes should be reviewed by peers” and “Merging should require passing status-checks” tests.

​
Data Access