How do I use Role Based Access Control?

How do I manage users with Role Based Access Control?

Role-Based Access Control (RBAC) allows you to grant and enforce access to functionalities and integrated repositories by assigning pre-defined roles to users. To give you better control over what functionality and data can be accessed by different users, these roles are assigned per individual repository. A single user can have one level of access rights for one repository and a different level for another. Anything a user can see and do in an integrated repository is defined by their role.

By default, once a new repository is integrated, only the company admin(s) get access to it (apart from the user integrating it), while other users are assigned the No access role. As a company admin, you are able to set the default role to one of your choice (up to the Reviewer role), which will be assigned to users every time a new repository is integrated. 

To do so:

1. Go to Admin tools
2. Input your password to enter the administrative mode
3. In the User permissions tab, click on the dropdown and select a role of your choice

User roles

We currently define seven different user roles:

No access

Users with this role can only see the name of the repository, but can’t access any more information.

Viewer

Recommended for non-code contributors who want to view or discuss your project. See details below.

Developer

Recommended for contributors who should be able to create pull requests and fix vulnerabilities. See details below.

Reviewer

Recommended for contributors who need to review and triage vulnerabilities and the like. See details below.

Maintainer

Recommended for contributors who don’t need to review and triage, but are able to manage the repository, perform manual uploads, and invite users. See details below.

Repository admin

Recommended for people who need full access to the repository, including reviews and triaging. See details below.

​​​​​​​Company admin

The highest level of access. Recommended for people who need full access to all repositories and settings. See details below.

Available actions per user role

How do I assign roles when inviting new users?

1. Go to Admin tools, or the Repositories/Vulnerabilities/Dependencies view
2. If needed, input your password to enter the administrative mode

   

    

3. Click on Invite users

   

    

4. Select the repository(s) you want the users to be invited to
5. Add the emails of the invitee(s)
6. Select a user role for each of the invitee
7. Click on Create invite
8. The invitation then shows up in the Invitations to send tab. Here you can Edit or Delete it if needed

   

    

9.  Once you review it, click on Send invite
10. The invitation then shows up in Sent invitations. Here you can withdraw the invitation by clicking on Delete

How do I modify access of an existing user?

1. Go to Admin tools
2. Input your password to enter the administrative mode

   

    

3. In the Users tab, find a list of users in your company. If you hover over the rule name in the User role column, you can see all of the current roles of that user and their scope(s)

   

    

4. To edit the role, click on the Edit button (pen icon) on the right side of the table

   

    

5. Click on the Handle access tab, or Handle access button

   

    

6. Here you can edit the user’s existing role(s) and their scope(s). To assign a new role click the + button