Integrations

Linear

Linear Integration

Pensar Console integrates with Linear to push security findings into your Linear workspace as issues and keep their status in sync. The integration uses a workspace-level OAuth 2.0 app — you authorize Pensar once, and there are no personal API keys to create or rotate.

Linear issues created by Pensar are attributed to the Pensar app, not to the person who connected the integration. The connection is approved by a Linear admin during the OAuth consent and is shared by everyone in your Pensar workspace.

Prerequisites

Before connecting Linear, ensure you have:

  1. A Linear workspace where you can approve installing an OAuth application (this requires a Linear admin)
  2. Admin or owner access to the Pensar Console workspace you want to connect

Connecting Linear

  1. Navigate to Settings → Integrations → Issue tracking in your Pensar Console workspace
  2. Find the Issue sync card and locate the Linear section
  3. Click Connect Linear
  4. You’ll be redirected to Linear’s OAuth consent screen — a Linear admin reviews the requested access and approves the app for your workspace
  5. You’ll be automatically redirected back to Pensar Console with Linear connected

Once connected, the Linear section shows the connected organization.

Permissions

When you authorize Pensar, the OAuth flow requests the following scopes:

ScopePurpose
readRead teams and issues to route and reconcile findings
issues:createCreate Linear issues for security findings
comments:createAdd comments to synced issues

What Gets Synced

Once connected and enabled, Pensar files each matching finding as a Linear issue in the routed team:

  • The issue title is prefixed with [Pensar Security]
  • The description includes the severity, affected location, CWE classification, and a direct link back to the finding in the Pensar Console
  • The finding’s severity maps to a Linear priority:
Pensar severityLinear priority
CriticalUrgent
HighHigh
MediumMedium
LowLow

Issues are created as the Pensar app, so they’re clearly attributable and don’t consume a Linear seat.

Routing Findings to Teams

Pensar routes findings to Linear teams with a workspace default plus optional per-repository overrides.

Default Team

  1. In the Linear section, set the Default team
  2. This is the fallback team Pensar files into for any repository without an override, and for findings that aren’t tied to a specific repository

Per-Repository Overrides

Each repository can override the default routing:

SettingDescription
Sync to LinearToggle whether findings from this repository are filed as Linear issues
TeamThe Linear team findings from this repository are filed in (falls back to the default team)
Severity FilterThe minimum severity required before a finding is filed as an issue

Select a team before enabling sync for a repository. Repositories without an override inherit the workspace default.

Backfilling Existing Findings

Turning on sync only affects findings discovered from that point on. To file findings you already have, use Sync existing findings in the Issue sync card. Pensar files every open finding that meets the routing and severity rules, skipping any that already has a linked Linear issue.

Two-Way Status Sync

Pensar to Linear

When a finding’s status changes in Pensar, the linked issue is moved to a workflow state of the matching type:

Pensar statusLinear state type
OpenUnstarted
In reviewStarted
ClosedCompleted
False positiveCanceled

Linear to Pensar

Status changes made in Linear flow back automatically through Linear’s app-level webhook. Pensar’s Linear app is configured with a single webhook that Linear sends for every workspace that authorized the app, so there is no per-workspace setup and no extra scope required:

Linear state typePensar status
BacklogOpen
UnstartedOpen
StartedIn review
CompletedClosed
CanceledFalse positive

Moving an issue to a canceled state marks the finding a false positive rather than closing it as fixed. Moving a completed issue back to an active state reopens the finding.

Inbound reflection can be turned off per provider with Reflect status changes from Linear, in the Linear section. With it off, Pensar remains the source of truth: findings still sync outward to Linear, but changes made in Linear are ignored.

Disconnecting Linear

To remove the Linear integration:

  1. Navigate to Settings → Integrations → Issue tracking
  2. Find the Linear section in the Issue sync card
  3. Click Disconnect

Disconnecting revokes Pensar’s access token for your Linear workspace.

Disconnecting Linear stops Pensar from filing new findings as Linear issues and ends two-way status sync. Existing Linear issues are left in place.

Troubleshooting

Connection Failed

If the OAuth authorization fails:

  1. Ensure you’re signed in to the correct Linear workspace
  2. Confirm a Linear admin approved the app during consent
  3. Verify you have admin or owner access to the Pensar Console workspace
  4. Try the Connect Linear flow again from Settings → Integrations → Issue tracking

Issues Not Being Created

If findings aren’t appearing in Linear:

  1. Confirm a Default team is set, or that the repository has a team override
  2. Check that Sync to Linear is enabled for the repository
  3. Verify the finding’s severity meets the repository’s Severity Filter

Status Changes Not Syncing

If moving a Linear issue to done doesn’t resolve the Pensar finding:

  1. Confirm the issue was originally filed by Pensar — status sync only applies to synced findings
  2. Check that Reflect status changes from Linear is enabled
  3. Confirm the state you moved to is of type completed, not a custom active state

Need Help?

If you encounter issues setting up your Linear integration, please contact our support team at team@pensar.dev.