Install Requests from CSRT Signed-Install scanner

Bitbucket Development Bitbucket Cloud
, ,
1

Hi

We have our 1st plugin deployed the other day, and I am seeing request for install from this payload:

{
  "key": "com.bit-booster.bb",
  "clientKey": "i0o23l16-9iiu-4hke-462z-yia560tbgfb3",
  "cloudId": "i0o23l16-9iiu-4hke-462z-yia560tbgfb3",
  "sharedSecret": "csrt-fake-secret-ignore",
  "baseUrl": "https://csrt-scanner-35001.atlassian.net",
  "eventType": "installed",
  "productType": "bitbucket",
  "oauthClientId": "i0o23l16-9iiu-4hke-462z-yia560tbgfb3",
  "description": "CSRT Signed-Install scanner, contact Atlassian EcoAppSec team for more info",
  "serverVersion": "6452",
  "pluginsVersion": "1.801.0"
}

What is this and should I just ignore them? Sorry if this is obvious, I never say this during the dev phase.

Thanks Robert

2

That is a request from one of the scanner instances of Atlassian, they use these instance to test aspects of your app.

You can ignore those, but don’t block them.

I filter them out when looking at logs as they will generate some authentication and authorisation errors in the logs that can be expected.