Skip to main content
Strix integrates natively with Linear so vulnerabilities found by scans and PR reviews can be exported as Linear issues and kept in sync in both directions. This page covers setup, the OAuth scopes requested, what data is exchanged, and how to disconnect.

​
Overview

​
Setup

  1. In Strix, go to Settings → Integrations and click Connect on the Linear card. You must be an organization admin, and your plan must include ticketing integrations.
  2. Approve the app on Linear’s standard consent screen (linear.app/oauth/authorize). Linear redirects back to https://app.strix.ai/api/integrations/linear/callback, where Strix exchanges the authorization code for a token and records the workspace.
  3. Back in Strix, pick a default team or project as the export destination, and optionally enable auto-sync with a minimum severity so new findings are exported automatically.

​
OAuth scopes requested

Linear issues long-lived access tokens (no refresh token), so the connection persists until it is disconnected or revoked.

​
What data flows where

Strix → Linear (when a vulnerability is exported, manually or via auto-sync):
  • Issue title: the vulnerability title.
  • Issue description: severity, CVSS/CVE (when present), target/endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
  • Priority mapped from severity, and a due date when an issue is snoozed.
  • Status comments (e.g. “marked In Progress by …”) when the Strix status changes.
Linear → Strix (via webhook on issue updates):
  • The issue ID/identifier, its workflow state type (e.g. started / completed), and the display name of the actor who made the change. Strix maps the state back onto the linked vulnerability’s status.
Strix does not read existing Linear issues, comments, or user directories; inbound processing is limited to status updates for issues Strix itself created.

​
Security

  • Admin-gated: both the connect and callback endpoints require an authenticated Strix org admin; the role is re-checked at the callback so a demoted user cannot complete a pending connection.
  • CSRF-protected OAuth: the OAuth state is HMAC-signed, bound to the initiating organization and user, and expires after 10 minutes.
  • Signed webhooks: Linear webhook deliveries are verified with HMAC-SHA256 signatures (timing-safe comparison) and a timestamp window to limit replay.
  • Token storage: the access token is stored server-side in Strix’s database, scoped to your organization, and never exposed to the browser or other tenants.
  • Revocation on disconnect: disconnecting the integration revokes the token on Linear’s side, so no live tokens remain.
  • Audit trail: connecting the integration and settings changes are recorded in the Strix audit log.

​
Disconnecting

An org admin can disconnect Linear at any time from Settings → Integrations, or via the API:
Required scope: integrations:write Disconnecting removes the stored token and revokes the OAuth grant. Issues already created in Linear are not deleted.