Linear Integration

​

Overview

​

Setup

1. In Strix, go to Settings → Integrations and click Connect on the Linear card. You must be an organization admin, and your plan must include ticketing integrations.
2. Approve the app on the standard Linear consent screen (linear.app/oauth/authorize). Linear redirects back to https://app.strix.ai/api/integrations/linear/callback. There, Strix exchanges the authorization code for a token and records the workspace.
3. In Strix, select a default team or project as the export destination. The picker lists your Linear teams first, then your projects. Select a team to create tickets in that team; select a project to create tickets in that project. You can also enable auto-sync with a minimum severity. Auto-sync exports new findings automatically. Under Sources, select which findings auto-sync exports: Pentests, Supply chain, or both. Both are on by default. Manual exports, bulk exports, and the API ignore this setting.
4. Optional: route findings to other teams or projects. Under Route by source, select a destination for pentests, PR reviews, or supply-chain findings. Under Route by repository, select a destination for findings from one repository. Both cards sit under Advanced on the settings page and are collapsed by default. See Route tickets.

​

Route tickets

1. The destination that you select in the export dialog.
2. The repository route of the repository that the finding belongs to.
3. The source route of the finding source.
4. The default team or project.

​

Route by source

​

Route by repository

​

Set routes through the API

curl -X PATCH "https://app.strix.ai/api/v1/integrations/linear/settings" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "source_routes": {
      "pr_review": { "collection_id": "<LINEAR_TEAM_OR_PROJECT_ID>", "collection_name": "AppSec" },
      "supply_chain": { "collection_id": "<LINEAR_TEAM_OR_PROJECT_ID>", "collection_name": "Dependencies" }
    },
    "repository_routes": [
      { "repository_id": "<REPOSITORY_ID>", "collection_id": "<LINEAR_TEAM_OR_PROJECT_ID>", "collection_name": "Payments" }
    ]
  }'

​

Ticket defaults

​

Default assignee

​

Title and description templates

​

Group tickets by pentest

​

Due date by severity

​

Preview and test ticket

​

Set defaults through the API

curl -X PATCH "https://app.strix.ai/api/v1/integrations/linear/settings" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "default_assignee_id": "<LINEAR_USER_ID>",
    "title_template": "[{{severity}}] {{title}}",
    "description_template": "{{details}}\n\nStrix: {{strix_url}}",
    "group_by_pentest": true
  }'

​

OAuth scopes requested

​

What data flows where

• Issue title: the vulnerability title.
• Issue description: severity, CVSS and CVE (when present), target, endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
• Priority mapped from severity, and a due date when an issue is snoozed.
• Status comments (for example, “marked In Progress by …”) when the Strix status changes.

• The issue ID and identifier, its workflow state type (for example, started or completed), and the display name of the actor who made the change. Strix applies the state to the status of the linked vulnerability.

​

Security

• Admin-gated: The connect and callback endpoints require an authenticated Strix org admin. Strix checks the role again at the callback. Thus a demoted user cannot complete a pending connection.
• CSRF-protected OAuth: The OAuth state is HMAC-signed and bound to the initiating organization and user. It expires after 10 minutes.
• Signed webhooks: Strix makes sure that each Linear webhook delivery has a correct HMAC-SHA256 signature (in a timing-safe comparison) and a timestamp in the permitted window. This limits replay.
• Token storage: Strix keeps the access token server-side in its database. The token applies only to your organization. The browser and other tenants cannot see it.
• Revocation on disconnect: When you disconnect the integration, Strix revokes the token on the Linear side. Thus no live tokens stay.
• Audit trail: The Strix audit log records the connection of the integration and the changes to the settings.

​

Disconnecting

curl -X DELETE "https://app.strix.ai/api/v1/integrations/linear" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"