Skip to main content

​
Overview

ZeroPath integrates with Linear to push security findings as Linear issues. When a Linear issue is completed, the corresponding ZeroPath finding is automatically marked as resolved.

​
Setup

  1. Navigate to Settings → Integrations in the ZeroPath dashboard.
  2. Click Add Integration and select Linear, then choose Automatic Webhook Setup (requires Linear admin) or Manual Webhook Setup.
  3. Authorize ZeroPath in the Linear consent screen.
  4. ZeroPath detects your Linear workspace and available teams.
The integration registers webhooks for all your Linear teams to enable bidirectional sync. Webhooks are configured with Issue and Comment resource types — Issue is required for status sync, while Comment is optional but enables smarter triage when tickets are closed. For manual webhook setup, select at minimum the Issue resource type. Adding Comment is recommended — it allows ZeroPath to analyze ticket comments and classify closed tickets more accurately.
Linear can be connected at either the organization level (shared across all members) or the user level (personal). Organization-level connections are recommended so that all team members can export findings to Linear without each needing their own connection. If both exist, the organization-level integration takes priority.

​
Manual Issue Export

From any finding in the ZeroPath dashboard:
  1. In the issue detail panel, open the More actions (⋯) menu and choose Export to Linear. The option is hidden once the issue already has a linked Linear issue.
  2. Select a Linear team and optionally an assignee.
  3. If you have a template configured (see Custom Templates), you can toggle “Use Linear Template” to apply it. Disable the toggle to manually edit the title and description before exporting.
  4. ZeroPath creates the Linear issue with vulnerability details. For secrets findings, the title, description, and code snippet are automatically redacted so that cleartext secret values are never written into Linear issues. The title is replaced with a generic label identifying only the affected file, and the description is withheld entirely.
The Linear issue ID is linked to the ZeroPath finding for tracking.

​
Ticket keys in ZeroPath

Once a finding has a Linear issue, its key, such as ENG-42, appears in monospace under the finding’s status on its row in Issues and on the metadata line of its board card. A finding linked to both Jira and Linear shows the Jira key first.
  • The key opens the issue in Linear in a new tab.
  • When ZeroPath recorded no link for the issue, the key shows as plain text without a link. When ZeroPath has no readable Linear key, the word “Linear” stands in for it.
  • ZeroPath does not display the Linear issue’s own status. Hover the key to see the tooltip “Linear ENG-42. Status is not synced from Linear; open the ticket to see it.” When no link was recorded, it reads “Linear ENG-42. Status is not synced from Linear, and no ticket link was recorded.”

​
Bulk Export

You can export multiple findings to Linear at once:
  1. Select the findings you want to export from the issues list.
  2. Click Export in the page header, then click Export to Linear in the Export Issues dialog. If no issues are selected, the issues matching the current filters are exported (up to the first 10,000).
  3. Select a Linear team and optionally an assignee.
  4. If a template is configured, you can toggle it on to apply the template to all exported issues.
  5. ZeroPath creates Linear issues for all selected findings in batches. Titles, descriptions, and code snippets for secrets findings are automatically redacted in all created issues.
Findings that have already been exported to Linear are automatically skipped. After the export completes, you will see a summary showing how many issues were exported, skipped, or failed.

​
Automatic Ticketing

Configure automatic issue creation:
  1. Go to Settings → Integrations, select Linear (listed under Personal), and open the Automatic Issue Export Configuration tab.
  2. Set a score threshold — only findings at or above this score create Linear issues. Findings that have never been assigned a score (for example, some SCA advisories with no CVSS data) are always excluded from auto-ticketing, regardless of the threshold value — a score gate can only pass what was measured. Secret findings must also carry a confirmed verdict: a secret the scanner flagged but the validator has not confirmed creates no issue, whatever its score. This prevents an issue from asserting a leak that was never verified.
  3. Choose which scan types trigger issues.
  4. Select the Linear team to create issues in.
Titles, descriptions, and code snippets for secrets findings are automatically redacted in all auto-created issues, so cleartext secret values are never written into Linear.

​
SLA Due Dates

Enable Set due date from SLA to stamp each created issue with the finding’s remediation deadline as the Linear due date — the earliest breach date across every SLA policy that covers the issue. This applies to both auto-created and manually exported issues. If no SLA policy covers the finding, no due date is set.

​
Auto-Assignment

Auto-ticketing supports automatic assignment of newly created Linear issues. You can configure assignment behavior in three ways:
  • Automatic (git blame) — ZeroPath analyzes git blame data for the affected file and matches contributors to Linear users by email or name. The best-matching Linear user is assigned to the issue. This is the default.
  • Fixed assignee — Always assign auto-created issues to a specific Linear user that you select.
  • Disabled — Do not assign auto-created issues to anyone.
When exporting issues manually (single or bulk), you can still pick an assignee in the export dialog. If you select an assignee manually, it always takes priority over the auto-assignment configuration.

​
Custom Templates

Auto-ticketing supports customizable title and description templates with variables:
  • {{severity}}, {{issueTitle}}, {{repositoryName}}, {{affectedFile}}, {{vulnClass}}, and more.
  • You can assign Linear labels (pulled from the selected team) and set a priority level (Urgent, High, Medium, Low, No Priority) for automatically created issues.
  • Custom variables can be mapped to ZeroPath finding data or set to static values.
To configure a template, open the Automatic Issue Export Configuration tab for Linear and click the Ticket Template field. The template editor provides:
  • Title and Description tabs for editing each template independently.
  • A variable picker to insert predefined or custom variables.
  • A live preview that shows how the template will render with example data.
  • The ability to reset to defaults at any time.
When exporting issues manually (single or bulk), you can choose whether to apply the configured template or use the default format.

​
Outbound Status Sync

When a ZeroPath finding is resolved or marked as non-exploitable, ZeroPath automatically pushes the status change to any linked Linear issue. The issue is completed and a comment is posted explaining the resolution. This sync runs continuously in the background, so linked issues stay up to date without manual intervention.

​
Bidirectional Sync

When a Linear issue’s state changes to completed, ZeroPath automatically:
  • Analyzes ticket comments to determine the appropriate status — Resolved, False Positive, or Accepted Risk
  • If no comments are present or the Comment resource type is not enabled, the finding defaults to Resolved
  • If comments are present but the intent cannot be determined with confidence, the status change is skipped rather than defaulting to Resolved, preventing incorrect triage
  • Records the change in the finding’s audit trail
When the same Linear issue is linked to more than one ZeroPath finding (for example, because a finding was carried forward across successive scans), completing the issue resolves all linked findings at once. Duplicate webhook deliveries for an issue that was already closed are automatically skipped — this includes findings that were closed because they are no longer detected in the latest scan, so those findings are never incorrectly re-triaged when Linear echoes their issue closure back. When ZeroPath closes a Linear issue because a finding was resolved or marked as non-exploitable, the comment it posts depends on how the resolution was determined. If the finding was explicitly verified as fixed (for example, by a merged pull request), the comment confirms the fix and includes a link to the merged PR. If the finding was marked as non-exploitable through validation, the comment includes the validation assessment explaining why the finding is not exploitable. If the finding was simply not observed in a scan, the comment states that ZeroPath did not detect the finding and clarifies that this is not a verification the issue was fixed — only that it was absent from the latest scan results. When you change the status of multiple findings at once (for example, marking many issues as false positive), ZeroPath syncs each update to Linear with controlled concurrency to stay within Linear’s rate limits. If an individual ticket update fails, the remaining updates continue — partial failures are logged without blocking the bulk action. This sync is powered by webhooks registered in Linear during setup. Unlike Jira, Linear webhooks do not expire. When you disconnect a Linear integration, ZeroPath automatically cleans up the associated webhooks. If multiple integrations share the same Linear workspace, webhooks are transferred to a remaining active integration rather than being deleted.

​
Repository Deletion

When a repository is deleted from ZeroPath, all Linear issues that were synced for findings in that repository are automatically closed before the repository is removed. This happens as a best-effort step — if closing an issue fails, the repository deletion still proceeds. Issues created for findings in other repositories are not affected.

​
Troubleshooting

“Linear integration not found”
  • Ensure the integration is connected in Settings → Integrations.
Issues not syncing back
  • Verify the Linear issue was created through ZeroPath (only linked issues sync).
  • Check that the issue state changed to “completed” (other states are ignored).