Connect once and choose the repositories MAGDOX may read. The first scan of each repository's default branch starts straight away. After that, every push to the default branch and every pull or merge request is scanned, and the result appears in your code host.
Connect
- A Super Admin or admin opens Connections in the console and chooses a code host. Connecting asks for a fresh code from your authenticator.
- GitHub: install the MAGDOX GitHub App on the account and choose its repositories.
- GitLab: sign in to gitlab.com, or paste a group, project or personal access token for gitlab.com or your own GitLab over https on a public address. read_api and read_repository let MAGDOX read; the api scope lets it report on merge requests with the Developer role, and add webhooks with the Maintainer role.
- Bitbucket Cloud: sign in with Bitbucket.
- Azure DevOps: enter your organisation and paste a personal access token with Code (read), Code (status), Pull request threads and Service hooks (read and write).
- Report results on the code host starts on: it posts commit statuses and pull request comments. With it off, results show only in MAGDOX, and you add each repository's webhook by hand: the Webhook button on Connections shows its address and secret.
- Choose the repositories, map each one to a MAGDOX repository and choose whether pull requests get a summary comment.
What MAGDOX may do
| Code host | Access | Why |
|---|---|---|
| GitHub | Contents and metadata: read. Checks and pull requests: write | Fetch the commit being scanned with a token limited to that repository, open the MAGDOX check and post the summary comment |
| GitLab | read_api and read_repository; api when you turn on Report results on the code host | Fetch the commit; with reporting on, add the webhooks, post the commit status and the merge request note |
| Bitbucket Cloud | Repositories, pull requests and webhooks | Fetch the commit, receive push and pull request events, post the build status and comment |
| Azure DevOps | What your personal access token allows | Fetch the commit, receive service hook events, post the status and the pull request thread |
What you see on a pull request
- A check or commit status with the counts and your policy result. Only a policy can fail it: policies come with Business and Enterprise, under Settings, Policies, so on Team findings never fail the check.
- On GitHub, up to 50 annotations on lines the pull request changed.
- One summary comment, unless you switched comments off: each new push updates it instead of adding another. MAGDOX's annotations and summary carry the finding's title, severity and location, never your code.
- Once an admin connects your organisation's own AI model, review comments from that model on up to 20 new findings, labelled as unverified AI suggestions, on repositories whose pull request comments are on. They are on by default, an admin can switch them off under Settings, Integrations, AI model, and they never change the check's result.
Rescans and new vulnerabilities
- Connected repositories are rescanned on a schedule: daily by default, or weekly, or off, at the hour (UTC) an admin chooses on the Connections page, up to the number of repositories a run they set and within your organisation's daily scan limit.
- Anyone with the SuperUser role can choose Scan now on the Connections page to scan the default branch at any time.
- When the vulnerability data updates, every repository's dependency inventory is checked again, without its code. New vulnerabilities appear as new findings and follow your alerts and policies.
Good to know
- On GitHub, pull requests from forks are scanned only when their author is an owner, member or collaborator of the repository; on GitLab, Bitbucket and Azure DevOps, pull requests from forks are not scanned. Strangers cannot spend your scans.
- Every scan, whatever started it, counts toward your organisation's limit of 200 hosted scans in any 24 hours. Past it, a push or pull request is not scanned: on GitHub the MAGDOX check says the daily limit was reached, and Re-run on that check scans it later; on the other hosts, push again later.
- Events from your code host are verified by signature or secret and checked for repeats before anything runs.
- Tokens are stored encrypted and never shown again. The code fetched for a scan is deleted when the scan ends; when a proof needs it, it is fetched again and deleted after that proof.
- Disconnecting removes the webhooks MAGDOX created and forgets the tokens; results stay. On GitHub, MAGDOX stops using the installation at once, and the MAGDOX GitHub App stays installed until an owner of the account removes it on GitHub.