DeepSource Integration with DefectDojo

DeepSource Integration with DefectDojo

DeepSource is a static analysis and code health platform from DeepSource Corp. It runs language analyzers against connected repositories and reports issue occurrences in categories such as security, bug risk, performance, anti-pattern, type check, style, documentation, and coverage, along with hits from a dedicated secrets analyzer and vulnerability advisories against project dependencies. DeepSource exposes its data through a GraphQL API rather than a REST API, and a saved GraphQL response in JSON is what DefectDojo imports from a file.

DeepSource Integration with DefectDojo

We connected DeepSource to DefectDojo because DeepSource is good at telling developers what is wrong in a pull request, and much less suited to telling a security team what is still open across forty repositories. In DefectDojo each DeepSource occurrence becomes a Finding on the Asset that owns the repository, with a severity that reflects whether it is a security weakness or a style nit, an owner, and an SLA. DefectDojo Pro customers can let the connector pull the data on a schedule. Teams that cannot hand over API credentials can import the same data as a file, and both routes land under the same scan type so they deduplicate against each other.

Why DeepSource Matters

DeepSource sits close to the developer, in the repository and the pull request, which is where static issues are cheapest to fix.

• One platform covers many languages, plus secrets and dependency advisories, so a single integration brings in several kinds of risk.
• Every occurrence names a file and line, which makes ownership straightforward.
• Issues carry a stable shortcode (for example PY-A6006), so the same rule can be tracked across repositories.
• DeepSource grades every issue CRITICAL, MAJOR, or MINOR regardless of category. Without a translation layer, a missing docstring and an injection flaw can look equally urgent.

Advantages of This Integration

What running DeepSource through DefectDojo gives a security team:

• Severity that means something. DefectDojo applies two ladders based on category. Security issues keep their grade (CRITICAL to Critical, MAJOR to High, MINOR to Medium), bug risk and similar categories drop one step, and style, documentation, and coverage arrive as Info.
• Committed credentials stand out. Any hit from the DeepSource secrets analyzer is imported as Critical, whatever DeepSource graded it.
• File and API data agree. The parser uses the same scan type string as the DeepSource connector, DeepSource - Connectors Import, so a team that starts with file uploads and later turns on the connector gets one set of findings instead of two.
• Stable identity. Each finding carries the DeepSource occurrence or vulnerability ID as its unique ID, which drives deduplication and reimport matching.
• SCA in the same place. Dependency advisories arrive with component name and version, CVE and GHSA identifiers, CVSS v3 and EPSS scores, and a plain statement when no fixed version exists.
• Platform workflow. Findings can be assigned, risk-accepted, marked false positive, measured against SLAs, and pushed to Jira like any other scanner's output.

How This Integration Works

There are two routes, and both use the DeepSource - Connectors Import scan type.

Option 1: File import (Community Edition and DefectDojo Pro). This path exists for organizations that cannot grant DeepSource API credentials, such as air-gapped networks or teams waiting on a security review. Save the JSON response of a query sent to the DeepSource GraphQL endpoint. The DefectDojo parser docs include an example query that requests a repository's issueOccurrences (with path, lines, and issue details) and its latest analysisRuns. The response is wrapped in data.repository, with each collection behind edges[].node. One file may carry issue occurrences, dependencyVulnerabilityOccurrences, or both, and the outer data wrapper may be omitted.

Import the file in the UI by opening an Engagement, choosing Import Scan Results, and selecting DeepSource - Connectors Import. To automate it:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" 
  -H "Authorization: Token $DD_API_TOKEN" 
  -F "scan_type=DeepSource - Connectors Import" 
  -F "file=@deepsource.json" 
  -F "product_name=billing-service" 
  -F "engagement_name=Static Analysis" 
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import 
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" 
  --scan-type "DeepSource - Connectors Import" 
  --report-path "./deepsource.json" 
  --product-name "billing-service" 
  --engagement-name "Static Analysis" 
  --auto-create-context

Later exports go to /api/v2/reimport-scan/ against the same Test so resolved occurrences are mitigated.

Option 2: DeepSource connector (DefectDojo Pro). The connector authenticates with a DeepSource personal access token sent as a bearer token. In the DefectDojo Pro UI:

1. Enter the DeepSource GraphQL API URL in the Location field (https://api.deepsource.com/graphql/ for the cloud platform, or your own host's GraphQL path if self-hosted).
2. Enter the personal access token in the Secret field.
3. Optionally set a Minimum Severity.

DefectDojo enumerates every account the token can see and creates a Record for each activated repository, which you map to a DefectDojo Asset. DeepSource reports the currently open set of occurrences rather than a per-finding status, so each sync reflects what is open at that moment.

Data Granularity: What Gets Imported

Use Cases

Across a repository fleet: A platform team with DeepSource on dozens of repositories uses the connector so each activated repository becomes a Record mapped to its Asset. Security leads report on open security-category issues by team without opening each repository in DeepSource.

In a restricted environment: An organization that cannot issue API tokens to an outside service saves the GraphQL response from inside its network and imports the file. When the security review clears, it enables the connector and the findings deduplicate against the earlier uploads.

For secrets hygiene: Because secrets analyzer hits always arrive as Critical, they fall under the shortest SLA. A team can filter on the analyzer tag to confirm every committed credential was rotated and the occurrence closed.

For dependency triage: Advisories with reachability, fixability, and EPSS context sit beside code issues for the same Asset, so an engineer can see which vulnerable packages matter before planning upgrades.

Operational Tips

• Decide early whether style, documentation, and coverage issues belong in DefectDojo. They import as Info, and minimum_severity=Low on import (or the connector's Minimum Severity) keeps them out.
• Keep your saved query's fields aligned with what the parser reads. The example query in the parser docs requests first: 100 occurrences, so check that the saved response contains everything you expect.
• Reimport each repository's export into the same Test. Occurrences missing from the new file are mitigated, which matches how DeepSource reports the currently open set.
• Use the shortcode in Vuln ID from Tool to find the same rule across repositories when deciding whether to fix it at scale or risk-accept it.
• Advisories with no published fix say so in Mitigation. Risk-accept them with an expiration date rather than leaving them unowned.
• If you move from file uploads to the connector, keep the same Assets. The shared scan type and unique IDs are what make the two sources deduplicate.