Connect GitHub Issues or Linear and each finding gets one ticket where your developers already work. Akadenia Security keeps it in step with the finding: no copying, and no ticket left open after the fix.
What happens to a ticket
| When | The ticket |
|---|---|
| A scan finds the problem | Opens, with what to do about it and a link back |
| Its severity changes | Gets a comment (and, in Linear, a new priority) |
| A scan confirms the fix | Gets a comment with the date, and closes |
| Verify fix confirms the fix | Gets a comment saying so, with who asked, and closes |
| Someone sets the finding aside | Gets a comment with the reason, and closes as not planned |
| The finding comes back, or is reopened | Reopens |
| It goes past its SLA due date | With Mark overdue findings on: see below |
And the other way, in GitHub:
| When someone, in GitHub… | The finding |
|---|---|
| Closes the issue as done | Is marked fixed. No extra scan runs: if the next scheduled scan still finds it, it comes back and the issue reopens |
| Closes it as not planned | Is set aside as accepted risk, saying who closed it |
| Reopens the issue | Comes back as it was |
A finding never gets a second ticket in the same tool, even after it's fixed and comes back: the same ticket reopens.
A ticket holds the finding's title, severity, target, scanner, when it was first seen, how to fix it, its OWASP and NIST mapping, and a link to the finding. It never holds the scanner's raw output, which can include things the scanner saw that shouldn't be copied around.
Connect
On the Tickets page, owners and admins choose Connect GitHub Issues or Connect Linear:
- GitHub: install the Akadenia Security app on your account or organization, giving it the repositories it may open issues in. It can only read and write issues there.
- Linear: approve access for your workspace.
Back on the Tickets page, choose where tickets go, then which findings get them:
By target: each target goes to its own repository (GitHub) or team (Linear), or gets No tickets. In Linear, a target can also get a label, so one team's tickets still sort by target. There's no default: a target you haven't chosen for gets no tickets, so a vulnerability is never filed somewhere nobody picked. A target you add later asks where its tickets go.
Tickets for: every finding the filters let through, or only the ones someone asks for (Create ticket on a finding). A new connection starts with only the ones someone asks for, so nothing is opened before you've chosen where.
Findings of: the least severity, for example medium and up.
Mark overdue findings: off unless you turn it on. With SLAs on, a ticketed finding that goes past its due date gets an
overduelabel (in Linear, also Urgent priority) and a comment, "Overdue since <date> (SLA <n> days)". The comment comes again every 7 days while it stays overdue, 5 more times at most. The label comes off when the finding is fixed or set aside.Assignees: a finding's owner becomes its ticket's assignee. Members are matched to people in the tool by email: in Linear by their account's email, in GitHub by a public email on their account. Under Assignees, pick the right person for anyone that doesn't match, or Don't assign. With no match the ticket stays unassigned. Unassigning a finding, or its owner leaving the organization, takes off the assignee the app set, but not one someone has since changed by hand.
A ticket stays where it was opened: changing a target's repository or team sends its new tickets there, and its open ones keep updating where they are.
Analysts and up can ask for a ticket on any finding from its details, with Create GitHub ticket or Create Linear ticket; the finding shows its tickets and whether they're open.
When a tool can't be reached
Updates are retried for about an hour. If 20 in a row fail, the integration is switched off and your owners and admins get an email; fix the problem (a removed repository, revoked access) and choose Switch back on.
Disconnect removes our access in the tool. Tickets already made stay, and connecting again picks them up rather than opening new ones.
For any other tool (Jira, Plane, Asana…), use webhooks with n8n, Zapier or Make.