HackerOne provides bidirectional GitLab integration for seamless data syncing between your HackerOne report and GitLab issues. Sync workflows from GitLab to HackerOne and vice versa, improving alignment between development and security teams and streamlining security vulnerability processing.
Creating a GitLab Issue
You can create new GitLab issues for reports you receive on HackerOne.
To create a new GitLab issue from your HackerOne report:
Go to the HackerOne report in your inbox that you want to create a new GitLab issue for.
Click next to References.
Select the GitLab integration you want the issue to link to in the dropdown and click Create.
Add comments or change the state of the report in GitLab.
When you act on the GitLab report, such as adding a comment or changing its status, Hackbot generates an internal comment on the HackerOne report to reflect the changes.
Linking HackerOne Reports to Existing GitLab Tasks
You can link your HackerOne reports to existing GitLab tasks.
To link your reports:
Go to the HackerOne report in your inbox that you want to link to GitLab.
Click References in the report sidebar.
Enter the GitLab ticket reference ID in the Reference ID field.
Click Link GitLab issue.
The HackerOne report will now be linked to the GitLab task, and all activities performed on the report will be synced to the corresponding task.
There's also another way you can link your HackerOne reports to GitLab. You can:
Go to the bottom of your HackerOne report.
Select Change state > Triaged in the action picker
Click Add reference to issue tracker.
Enter the GitLab ticket number in the Reference ID field.
Click Create.
Syncing Updates from HackerOne to GitLab
With the GitLab integration, you can sync these report updates to GitLab:
Report Comments
State changes
Rewards
Assignee changes
Public disclosure
Close GitLab issue
All updates on a report are synced as a comment to GitLab. Additionally, all actions are configurable and can be toggled from the GitLab integration settings page.
Syncing Updates from GitLab to HackerOne
To make sure your security team stays up to date with the changes that happen in GitLab, you can sync back activities from GitLab to the HackerOne report. All updates from GitLab will be reflected in HackerOne as an internal comment on the associated report.
We currently support these activities from GitLab to HackerOne:
Comments
State changes
You can choose which events you want to synchronize from GitLab as each activity can be toggled individually.
HackerOne Severity to GitLab Label Mapping
You can map HackerOne severity ratings to a GitLab label when configuring your integration. This enables the right priority to be set when escalating a report to GitLab.
Due Date Mapping
The integration can be configured to automatically set a due date based on the severity of a report.
Installing the GitLab Integration
See the GitLab Setup page.