Connect Jira

Connect Jira to turn security findings into Jira tasks. Once connected, you can create a task from any finding by hand, and set rules that create tasks automatically. Connecting Jira is an admin action, and you need permission to authorize an OAuth app on your Jira org.

Connect and map repositories

1. Connect your Jira org

   Go to Integrations and connect Jira. Sourcery sends you to Jira to authorize the connection, then brings you back.

2. Map repositories to projects

   Map each repository to a default Jira project. Tasks from that repository’s findings go to the project you choose. You don’t need to map everything: set an org-wide default project as the fallback for any repository you skip.

Autocreate rules

Autocreate opens a Jira task for a finding the moment a scan reports it. It’s available on the Team plan. These controls decide which findings qualify:

Control	What it does
Minimum severity	Findings below this severity never autocreate a task.
Issue types	Turn autocreate on or off for SAST, IaC, secret, dependency, and license findings.
Maximum issues per day	Limits how many tasks autocreate can open in a day, so a noisy scan can’t flood a project.

Note

Autocreate runs as part of a security scan, so it needs security scanning turned on. Creating a task by hand does not.

Create tasks by hand

With Jira connected, you can open a task from any finding without turning on autocreate. Do this from the security findings page, where each finding offers a create-task action. Use it to escalate one finding without flooding Jira with the rest.

What’s next

Triage findings Set severity and status before tasks reach Jira.

Security findings Read what a finding contains and how to act on it.