Skip to main content
Strix connects natively to Linear. Strix can export the vulnerabilities that scans and PR reviews find as Linear issues, and keep the statuses synchronized in both directions. This page describes the setup, the OAuth scopes that Strix requests, the data that Strix and Linear exchange, and the disconnect procedure.

​
Overview

​
Setup

  1. In Strix, go to Settings → Integrations and click Connect on the Linear card. You must be an organization admin, and your plan must include ticketing integrations.
  2. Approve the app on the standard Linear consent screen (linear.app/oauth/authorize). Linear redirects back to https://app.strix.ai/api/integrations/linear/callback. There, Strix exchanges the authorization code for a token and records the workspace.
  3. In Strix, select a default team or project as the export destination. You can also enable auto-sync with a minimum severity. Auto-sync exports new findings automatically.

​
OAuth scopes requested

Linear supplies long-lived access tokens (no refresh token). Thus the connection continues until you disconnect it or revoke it.

​
What data flows where

Strix → Linear (when you export a vulnerability manually, or when auto-sync exports it):
  • Issue title: the vulnerability title.
  • Issue description: severity, CVSS and CVE (when present), target, endpoint or affected file, impact, technical analysis, evidence, suggested fix or remediation steps, proof of concept, and a link back to the issue in Strix.
  • Priority mapped from severity, and a due date when an issue is snoozed.
  • Status comments (for example, “marked In Progress by …”) when the Strix status changes.
Linear → Strix (through a webhook on issue updates):
  • The issue ID and identifier, its workflow state type (for example, started or completed), and the display name of the actor who made the change. Strix applies the state to the status of the linked vulnerability.
Strix does not read existing Linear issues, comments, or user directories. Inbound processing applies only to status updates for the issues that Strix created.

​
Security

  • Admin-gated: The connect and callback endpoints require an authenticated Strix org admin. Strix checks the role again at the callback. Thus a demoted user cannot complete a pending connection.
  • CSRF-protected OAuth: The OAuth state is HMAC-signed and bound to the initiating organization and user. It expires after 10 minutes.
  • Signed webhooks: Strix makes sure that each Linear webhook delivery has a correct HMAC-SHA256 signature (in a timing-safe comparison) and a timestamp in the permitted window. This limits replay.
  • Token storage: Strix keeps the access token server-side in its database. The token applies only to your organization. The browser and other tenants cannot see it.
  • Revocation on disconnect: When you disconnect the integration, Strix revokes the token on the Linear side. Thus no live tokens stay.
  • Audit trail: The Strix audit log records the connection of the integration and the changes to the settings.

​
Disconnecting

An org admin can disconnect Linear at any time from Settings → Integrations, or through the API:
Required scope: integrations:write The disconnect operation removes the stored token and revokes the OAuth grant. Strix does not delete the issues that it already created in Linear.