Problem

Implementing DevSecOps in Bitbucket currently requires integrating multiple third-party tools for capabilities such as:

• Static application security testing (SAST)
• Secret scanning
• Dependency vulnerability scanning
• Container scanning
• Infrastructure-as-Code scanning
• SBOM generation
• Vulnerability management

Each integration adds configuration, maintenance, pipeline complexity and operational overhead. Teams also need to aggregate results from multiple tools to get a complete view of security findings.

Proposal

Introduce native DevSecOps capabilities within Bitbucket as optional modules that can be enabled as required.

Potential capabilities include:

• Code security (SAST)
• Secret detection
• Dependency and supply chain analysis
• Container and Infrastructure-as-Code scanning
• SBOM generation
• AI-powered security reviews
• AI-assisted remediation
• Unified security dashboard and reporting

The implementation could remain modular, allowing customers to enable only the capabilities they require while still supporting third-party integrations for organisations with specialised needs.

Benefits

• Reduced pipeline complexity
• Fewer third-party integrations
• Lower maintenance effort
• Consistent developer experience
• Faster adoption of DevSecOps practices
• Native AI-driven security insights and remediation
• Centralised visibility into security posture

Modern development platforms are increasingly expected to provide an integrated DevSecOps experience. Providing these capabilities natively would simplify adoption, improve developer productivity and reduce the operational overhead associated with managing multiple security tools.