Skip to main content

Quickstart

Get your first pull request scanned in a few minutes.

Before you start​

  • A Musha account. New organizations get a 14-day trial with no card required. The trial covers 2 active developers, 50 scans and GitHub repositories only. See Trial and cancellation.
  • A repository on GitHub, GitLab, Azure DevOps or Bitbucket.
  • Admin or Owner role in your Musha organization. Connecting repositories and creating CI keys is admin-only.
  • Permission to edit the CI configuration of the repository.

Step 1: Create a project​

  1. Open app.mushasec.com and go to Projects.
  2. Click New project.
  3. Enter a name and the repo URL (for example https://github.com/acme/backend-api). The platform is detected from the URL.
  4. Click Create.
note

The repo URL and the platform can't be changed after the project is created. If you picked the wrong repository, create a new project.

Step 2: Authorize your CI​

Open the project and go to its Integration tab (the same guide opens from the integration icon in the project list). Under Pull request scan, the steps depend on your platform.

GitHub or GitLab: OIDC, no stored secret
  1. Enter the repository (owner/repo on GitHub, group/project on GitLab). Optionally pin a branch or ref.
  2. Click Connect repository.
  3. Copy the workflow file that appears and commit it to the repository.

Musha only accepts scans from a repository you connected here. See GitHub Actions and GitLab CI.

Azure DevOps or Bitbucket: project-scoped CI key
  1. Click Create CI key. This opens CI keys with the project preselected.
  2. Choose an expiry date (required, one year at most) and create the key. Copy it right away: it is shown only once.
  3. Store it as a secret named MUSHA_API_KEY in your CI.
  4. Copy the pipeline snippet from the guide into your pipeline file.

The key can only create scans for that one project. See Azure DevOps and Bitbucket Pipelines.

Step 3: Connect your Git provider for comments​

To post the comment on pull requests, Musha needs a connection to your Git provider. Go to Settings > Integrations and connect GitHub, GitLab, Azure DevOps or Bitbucket. The connected account needs write access to the repository.

Without it the scan still runs and appears in the app, but no comment is posted.

Step 4: Open a pull request​

Open a pull request against your repository. The job runs on the pull request only, never on a bare push.

When it finishes:

  • The scan appears under CI scans in the app.
  • Musha posts a comment on the pull request with the findings.
  • On GitHub, the job fails if the scan is blocked by your policy. On the other platforms, read how blocking works there.

By default only critical findings block a merge, and only if the pull request introduced them. You can change the threshold in Settings > Scan Policy.

If nothing shows up, see Troubleshooting.

Optional: Scan the whole repository​

The pull request scan looks at what a PR adds. To also track what is already in the repository, and catch vulnerabilities published after a clean merge, with your provider already connected, choose Daily or Weekly in Settings > Scan Policy.

Results show up in Repository scans and Findings. See How it works.

Next steps​