Integrations

There are three ways findings reach Sinterly: a pull connector that fetches on a schedule, a file import you upload or post from CI, and the ingest API for automation. Ticketing is separate and flows outward.

All of them land in the same finding model with the same identity rules, so you can move between them without creating duplicates.

Every credential you store is encrypted with AES-256-GCM before it reaches the database and is never shown again, not even to you. The application has no ability to decrypt them; only the pipeline can, and only in memory at the moment it runs. Connections are tested against the live service before they can be saved, so a credential that does not work cannot be stored.

Available now: pull connectors

GitHub Code Scanning

What it does. Pulls the newest code scanning analysis per tool on each repository's default branch. This is the highest-leverage connector, because every scanner that publishes into GitHub code scanning becomes available through one integration: CodeQL, Semgrep, Trivy, Gitleaks, Checkov and many more.

Covers. SAST, SCA, secrets and infrastructure as code, depending on which scanners you run in GitHub.

What you provide.

Field	Value
GITHUB_TOKEN	A fine-grained personal access token with Code scanning alerts: read-only, or a classic token with the `security_events` scope
GITHUB_REPOS	Repositories as `owner/name`, comma separated

Setup. Integrations, then GitHub Code Scanning, then Connect. Paste the token and the repository list, test the connection, save.

The token cannot read your source code. That is the point of using a code scanning scope rather than a repository scope. Private repositories require GitHub code security on your GitHub plan; public repositories work on the free tier.

Snyk

What it does. Pulls findings from your Snyk organisation across their software composition analysis, code analysis and infrastructure as code products.

Covers. SCA, SAST, IaC.

What you provide.

Field	Value
SNYK_API_TOKEN	A Snyk API token
SNYK_ORG_ID	Your Snyk organisation identifier

Snyk API access requires a paid Snyk plan. The Snyk free tier does not include REST API access, so this connector cannot work on it. If you are on the free tier, export SARIF from Snyk and use the file import instead.

SonarCloud

What it does. Pulls open issues of type Vulnerability for each project you list.

Covers. SAST.

What you provide.

Field	Value
SONARCLOUD_TOKEN	A SonarCloud user token
SONARCLOUD_ORGANIZATION	Your organisation key
SONARCLOUD_PROJECTS	Project keys, comma separated

The organisation key and project keys appear on each project's Information page in SonarCloud. SonarCloud is free for public projects.

How often connectors run

Connected sources are pulled once a day automatically. You can also run a sync immediately from the Integrations page. If you only upload files, a separate nightly job still refreshes exploitation data such as KEV and EPSS on your existing findings, so a dependency that becomes known-exploited next month is re-prioritised without you doing anything.

Available now: file imports

Format	Use it for
SARIF 2.1.0	Any scanner that exports SARIF. Verified against Semgrep and Trivy; Grype, ZAP, Gitleaks, Checkov and CodeQL are recognised and mapped to the correct source tool.
CSV	Tools with no SARIF export. Columns are matched by name, case insensitively, against a wide list of aliases.
OTM 0.2.0	Threat models from IriusRisk, or from a pytm script via the adapter.

Full details, including the CSV column aliases, are in File imports.

Available now: ticketing

Jira

What it does. Creates tickets from scored findings, and brings ticket status changes back into Sinterly through a confirmation queue so that closing a ticket never silently closes a vulnerability.

What you provide.

Field	Value
Site URL	For example `https://your-team.atlassian.net`
Account email	The Atlassian account the token belongs to
API token	An Atlassian API token
Project key	For example `SEC`
Issue type ID	Optional. Set this if your project uses a custom issue type.

See Jira and ticketing for what a ticket contains and how the return path works.

On the roadmap

These appear in the Integrations page with a Register interest button. Registering interest is not a mailing list signup. It tells us which connector to build next, and it is the main input into that decision.

Scanners

Connector	What it would do
Black Duck	Pull software composition analysis findings, binary analysis results and licence compliance issues, for teams standardised on Black Duck rather than Snyk.
StackHawk	Pull dynamic application security testing results, so runtime findings against a deployed environment sit alongside static ones.
Escape	Pull dynamic testing results with an API-first emphasis, which suits teams whose main surface is an API rather than a web front end.
BugCrowd	Pull bug bounty submissions, so externally reported issues enter the same prioritisation and ticketing flow as scanner output rather than living in a separate inbox.

Ticketing

Connector	What it would do
Asana	Create and reconcile tasks the same way the Jira integration does, for teams that plan work in Asana.
Azure DevOps	Create and reconcile work items in Azure Boards, for teams already standardised on the Microsoft toolchain.

A connector you need is missing? Register interest in the application, or contact us through the in-app help menu. Because SARIF and CSV import accept output from effectively any tool, a missing connector is a convenience gap rather than a blocker. You can always export and upload today.