Some repositories may have specific requirements for vulnerability detection which differ from the rules defined globally.

To address repository-specific needs, you can use a per-repository configuration file. This file is committed to an individual repositories and affects only the repository where they are committed. When this option is enabled, Security for Bitbucket looks for a file named soteri-security.yml at the root of the repository. You will need to create and commit this file yourself if the repository has no soteri-security.yml yet.

Rules and options configured in this file are used both when repository content is updated (if Soteri - Scan Commits hook is enabled) and when you trigger scan manually from Security Scan tab of the repository.

As of version 3.10.0, this file is always loaded from the latest commit of the default branch. This ensures that scans of even historical branches are conducted with the most up-to-date configuration.

Per-repository configuration is disabled by default. The global settings page has a toggle to enable custom repository rules support:

The per-repository rules configuration toggle on Security For Bitbucket's global settings page.

Supported Configuration

This table documents all supported soteri-security.yml configuration options.

Option key

Description

inherit_builtin_rules (default true)

Set this to false to NOT inherit built-in rules. If true, file contents are checked against globally enabled built-in rules.

inherit_custom_rules (default true)

Set this to false to NOT inherit globally defined custom rules. If true, file contents are checked against globally defined and enabled custom rules.

rules

Use this field to apply a specific set of built-in rules that will always apply, regardless of inherit_builtin_rules.

Use in conjunction with inherit_builtin_rules: false to define a specific set of built-in rules to check against. Alternately, if inherit_builtin_rules is true, use this field to re-enable one or more globally disabled built-in rules.

Rule names can be referenced from the settings page, or Built-In Scanning Rules.

custom_rules

Use this field to define and apply your own custom rules. Rules are defined as key value pairs{rule_name}: {rule_regexp} with the same formatting as the custom rules page.

allowlist_paths

Use this list to mark specific files or paths (using a regular expression as the value) as allowed even if they contain vulnerabilities. This can be useful for storing some non-sensitive credentials and configuration data. See more details on allow-listing here: Allow-listing Detected Secrets

Below is an example of a soteri-security.yml config:

inherit_builtin_rules: false
inherit_custom_rules: false
rules:
   - RSA_PRIVATE_KEY
   - SSH_PRIVATE_KEY
custom_rules:
  # Comments are supported.
  BITCOIN_ADDRESS: '^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$'
  YOUTUBE_LINKS: '<a\s+(?:[^>]*)href=\"((?:https|http):\/\/\w{0,3}.youtube+\.\w{2,3}\/watch\?v=[\w-]{11})">(?:.*?)<\/a>'
allowlist_paths:
  - config/server.yml
  - (.*)\.insecure
YAML

Pre-Receive Hook

When Security for Bitbucket is installed and enabled, any changes which might invalidate soteri-security.yml on the default branch will be blocked by an included pre-receive hook. Changes which can be rejected must both:

  • Target a repository’s default branch. This includes:

    • Direct pushes to the default branch.

    • The merging of pull requests which target the default branch.

  • Modify soteri-security.yml such that it is no longer valid. Examples of potential reasons soteri-security.yml could be invalid:

    • Doesn’t parse as a valid YAML. You can use online tools to check that your YAML is valid before committing, like this one.

      • Note that the YAML standard forbids tab characters. You must use spaces in soteri-security.yml.

    • Properties don’t parse as expected (e.g. inherit_builtin_rules must be parsable as a boolean).

    • Provided regular expressions are invalid (e.g. for allowlist_paths or any defined custom_rules). You can use online tools to validate that your regexes are valid before committing, like this one.

    • Rule names that don’t have regular expressions associated with them.