> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations Overview

> Connect CodeThreat to your version control system

CodeThreat integrates with all major version control systems to scan your repositories for security vulnerabilities.

## Supported Platforms

<CardGroup cols={2}>
  <Card title="GitHub" icon="github" href="/integrations/github">
    GitHub Cloud with OAuth, GitHub App, or Personal Access Token
  </Card>

  <Card title="GitLab" icon="gitlab" href="/integrations/gitlab">
    GitLab Cloud and Self-Hosted with OAuth or Personal Access Token
  </Card>

  <Card title="Azure DevOps" icon="microsoft" href="/integrations/azure-devops">
    Azure DevOps with OAuth or Personal Access Token
  </Card>

  <Card title="Bitbucket Cloud" icon="bitbucket" href="/integrations/bitbucket-cloud">
    Bitbucket Cloud with OAuth or App Passwords
  </Card>

  <Card title="Bitbucket Server" icon="server" href="/integrations/bitbucket-server">
    Bitbucket Server (Data Center) with Personal Access Tokens
  </Card>
</CardGroup>

***

## Connection Methods

Different platforms support different authentication methods:

| Platform             | OAuth | GitHub App | Personal Access Token | App Password |
| -------------------- | ----- | ---------- | --------------------- | ------------ |
| **GitHub**           | ✅     | ✅          | ✅                     | —            |
| **GitLab**           | ✅     | —          | ✅                     | —            |
| **Azure DevOps**     | ✅     | —          | ✅                     | —            |
| **Bitbucket Cloud**  | ✅     | —          | —                     | ✅            |
| **Bitbucket Server** | —     | —          | ✅                     | —            |

### Which Method Should You Use?

<Tabs>
  <Tab title="OAuth (Recommended)">
    **Best for**: Most users and teams

    **Pros**:

    * Quick and easy setup
    * No manual token management
    * Automatic token refresh
    * Revocable from VCS settings

    **Cons**:

    * Requires browser access
    * May need org admin approval
  </Tab>

  <Tab title="GitHub App">
    **Best for**: GitHub organizations with fine-grained control needs

    **Pros**:

    * Granular repository access
    * Organization-wide installation
    * Better rate limits
    * Enhanced security

    **Cons**:

    * GitHub only
    * Requires org admin to install
  </Tab>

  <Tab title="Personal Access Token">
    **Best for**: Self-hosted instances, automation, CI/CD

    **Pros**:

    * Works with self-hosted VCS
    * No OAuth redirect needed
    * Full control over permissions
    * Good for automation

    **Cons**:

    * Manual token creation
    * No automatic refresh
    * Must be kept secure
  </Tab>
</Tabs>

***

## What Permissions Does CodeThreat Need?

CodeThreat requests **read-only access** to your repositories:

### Repository Access

* ✅ **Read repository content**: To scan code for vulnerabilities
* ✅ **Read repository metadata**: To display repo names, branches, commits
* ✅ **Read pull requests**: To scan PR changes
* ❌ **Write access**: CodeThreat never modifies your code

### Webhook Access

* ✅ **Create webhooks**: To receive notifications about commits and PRs
* ✅ **Read webhook events**: To trigger automatic scans

### Pull Request Integration (Optional)

* ✅ **Read PR changes**: To scan only modified code
* ✅ **Post PR comments**: To provide security feedback (if enabled)
* ✅ **Create checks**: To show pass/fail status (GitHub only)

<Note>
  CodeThreat operates on a **read-only** basis. We never push commits, modify files, or change repository settings.
</Note>

***

## How Connections Work

When you connect a VCS platform:

<Steps>
  <Step title="Authentication">
    You authorize CodeThreat to access your account via OAuth, token, or app installation
  </Step>

  <Step title="Repository Discovery">
    CodeThreat fetches a list of repositories you have access to
  </Step>

  <Step title="Repository Selection">
    You choose which repositories to import for scanning
  </Step>

  <Step title="Webhook Setup">
    CodeThreat creates webhooks to receive notifications about code changes (if automated scanning is enabled)
  </Step>

  <Step title="Initial Scan">
    CodeThreat automatically runs an initial security scan on imported repositories
  </Step>
</Steps>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="GitHub Integration" icon="github" href="/integrations/github">
    Connect GitHub repositories
  </Card>

  <Card title="Automated Scanning" icon="repeat" href="/scanning/automated-scanning">
    Set up automatic scans
  </Card>
</CardGroup>