Aikido Security
Connect Aikido Security: the API client to create, what Noru collects and never collects, the controls it covers, and troubleshooting.
- Authentication
- API key
- Categories
- Security
- Sync cadence
- Daily by default (hourly, weekly, or monthly on request)
Noru reads your Aikido Security workspace with a read-only REST API client. It collects issue counts and statuses across every scanner Aikido runs (open-source dependencies, static code analysis, leaked secrets, infrastructure as code, cloud posture, containers and surface monitoring), the open issue backlog, the repositories, containers, cloud accounts and domains Aikido scans, and a hash of sampled software bills of materials. It never changes anything in Aikido and never reads source code or code snippets.
What Noru collects
| Evidence type | Evidence | What it contains |
|---|---|---|
| Scan result | Aikido Vulnerability Scanning | How many repositories, containers, clouds and domains Aikido scanned and when it last scanned. Issue counts by status (open, closed, ignored, snoozed), open issues by severity and type, open issues past their remediation date, and your remediation SLA per severity. |
| Scan result | Aikido Open Issue Backlog | Each open issue group, highest severity first: title, type, severity and score, status, how to fix, related CVEs, first detection, and where it was found. |
| Scan result | Aikido Code Scanning (SAST) | The repositories Aikido scans with static analysis and when, and open and closed code findings by severity. |
| Scan result | Aikido Dependency Scanning | How many repositories have a usable lockfile, which have none or a faulty one, and open and closed dependency, malware and end-of-life issues. |
| Scan result | Aikido Secrets Scanning | How many repositories are scanned for embedded secrets, and open and closed leaked secrets by severity. |
| Scan result | Aikido Cloud & IaC Misconfigurations | Connected and scanned cloud accounts, and open and closed cloud, infrastructure-as-code and source control misconfigurations. |
| Scan result | Aikido License Compliance | Open and closed open-source license issues. |
| Inventory | Aikido Cloud Accounts | Each connected cloud account: name, provider, environment, last scan. |
| Inventory | Aikido Code Repositories & Containers | Each repository (name, provider, branch, last scan, lockfile state) and each active container image (name, tag, registry, distribution, last scan). |
| Inventory | Aikido Attack Surface | Each domain or API in surface monitoring: domain, kind, last scan. |
| Inventory | Aikido SBOM Coverage | Which repositories can produce an SBOM (scanned, with a usable lockfile), and for up to three sampled repositories per sync: the SHA-256 hash, CycloneDX serial number and version, component count and generation time of the SBOM. |
Each open issue group also becomes a security finding.
What Noru does not collect
- Source code, code snippets, file contents, or line-level locations.
- The SBOM documents themselves. Noru fetches a few each sync, keeps the hash and header, and discards the rest.
- Aikido users, their emails, or login history.
- Comments, activity log entries, or task tracker links.
- Aikido's own compliance reports and scores.
Repositories, containers, clouds and domains are listed in evidence only. They are not added to the asset register, because the source control and cloud data sources already put them there.
Controls it covers
Each evidence row is linked only to controls whose catalog already lists a matching kind of evidence, and only while the row's data shows it (the condition column). A link whose condition stops holding is removed on the next sync.
| Evidence | Control | As evidence of | Condition | Framework references |
|---|---|---|---|---|
| Vulnerability Scanning | Vulnerability Scans (VM-01) | Scanning evidence | An asset is scanned | ISO 27001 A.8.8, SOC 2 CC3.2, CC7.1 |
| Vulnerability Scanning | Vulnerability Scanning (VM-34) | Vulnerability assessments | An asset is scanned | NIS2 |
| Vulnerability Scanning | Vulnerability Scans: Trend Analysis (VM-04) | Sample vulnerability remediation | An issue was closed | |
| Vulnerability Scanning | System Security Monitoring (SM-25) | Sample of alerts generated | Aikido raised an issue | ISO 27001 A.8.16, SOC 2 CC6.8, CC7.2, CC7.3 |
| Open Issue Backlog | Backlog Prioritization (VM-23) | Sample identified bugs | Open issue groups | |
| Code Scanning (SAST) | Cybersecurity & Data Privacy Testing Throughout Development (SLC-27) | Application security testing | A repository is scanned | NIS2 |
| Code Scanning (SAST) | Code Security Check (VM-13) | Latest vulnerability assessment report | A repository is scanned | ISO 27001 A.5.8, A.8.25, A.8.29 |
| Dependency Scanning | Third-Party Library Check (VM-15) | Latest vulnerability assessment report | A repository with a usable lockfile | |
| Secrets Scanning | Embedded Authenticators (VM-17) | Latest vulnerability assessment report | A repository is scanned | |
| Cloud & IaC Misconfigurations | Configuration Checks (CFM-07) | Configuration deviation samples | A cloud is scanned, or infrastructure-as-code issues exist | ISO 27001 A.8.18, SOC 2 CC6.8, CC7.1 |
| Cloud Accounts | Third-Party Inventories (TPM-15) | Cloud service provider inventory | Cloud accounts connected | NIS2 |
| Cloud Accounts | Inventory Management (AM-01) | Asset inventory | Cloud accounts connected | SOC 2 CC6.1 |
| Code Repositories & Containers | Inventory Management: Applications (AM-02) | Asset inventory | Repositories or containers | SOC 2 CC6.1 |
| Code Repositories & Containers | Asset Inventories (AM-17) | Software asset inventory | Repositories or containers | NIS2 Article 21(2)(i) |
| Attack Surface | Attack Surface Scope (VM-25) | Attack surface scope | Domains monitored | |
| License Compliance | Software Usage Restrictions (SG-17) | Software monitoring compliance report | A repository with a usable lockfile | |
| SBOM Coverage | Software Bill of Material (AM-13) | Software bill of materials | An SBOM was sampled and hashed this sync |
Evidence supports a control; it does not prove it on its own. Some controls are deliberately not linked, because the catalog lists no evidence Aikido reports for them: penetration testing (VM-06, VM-36), since scanner and AI pentest results are not a penetration test report; Secrets in Code (SLC-03), whose evidence is a secrets vault and rotation logs; baseline configurations (CFM-17); anti-malware (VM-09, PS-06), since Aikido's malware issues are malicious packages, not endpoint protection; the cardholder data environment variants; and patch management (VM-08, VM-31).
Findings
One finding per open Aikido issue group, with Aikido's severity, title, CVE and how-to-fix text, and the repositories, containers or clouds it was found in. Cloud, infrastructure-as-code and source control issues are configuration findings, license issues are compliance findings, and everything else is a vulnerability finding. Turning off vulnerability alerts on the data source stops the vulnerability findings. A finding resolves on the next sync once Aikido closes, ignores or snoozes the group.
Before you connect
- The region your workspace is in: the address you sign in at
(
app.aikido.devfor the EU,app.us.aikido.dev,app.au.aikido.devorapp.me.aikido.dev). - A REST API client. A workspace admin creates one in Aikido under
Settings → Integrations → Public REST API, with only these read scopes:
basics:read,issues:read,repositories:read,clouds:readanddomains:read. Copy the client ID and secret. - Admin or editor role in Noru.
Connect
Choose your own Data source name. See Naming and using connection dialogs for naming, scrolling, and closing behavior.
The connection syncs daily; change the frequency in the detail drawer.
After connecting
Aikido allows 20 API calls a minute per workspace, so Noru spaces its calls and a sync of a large workspace takes a few minutes. A client without one of the scopes still syncs the rest: the evidence that could not be read keeps its last version.
To replace the API client, disconnect the data source and connect it again with the new client ID and secret.
Permissions in detail
| Scope | Why Noru needs it | What it could technically allow |
|---|---|---|
basics:read | Workspace identity and SLA settings | Read workspace settings |
issues:read | Issue counts, backlog and findings | Read every issue, including code locations Noru discards |
repositories:read | Repositories, containers, SBOM sample | Read repository and container details and export SBOMs |
clouds:read | Cloud accounts | Read connected cloud account details |
domains:read | Attack surface | Read monitored domains |
None of these allow Noru to change a setting, ignore an issue, or start a scan.
Troubleshooting
- "Aikido did not accept the client ID and secret. Check that you copied them from the same Aikido workspace and region, then try again." Also check the region matches the address you sign in at.
- "The Aikido API client does not have the read permissions Noru needs. Grant the read scopes listed in the setup guide and try again."
- "Noru could not connect to Aikido. Check the region, client ID and secret, then try again."
- A revoked client marks the data source Needs reauthentication. Create a new client and reconnect.
- No SBOM coverage link: no repository has been scanned with a usable lockfile.
Last updated on