Update security warnings.

cmd/server.go

@@ -438,10 +438,13 @@ func (s *ServerCmd) trimAtSymbolFromUsers(userConfig *server.UserConfig) {
 
 func (s *ServerCmd) securityWarnings(userConfig *server.UserConfig) {
 	if userConfig.GithubUser != "" && userConfig.GithubWebHookSecret == "" && !s.SilenceOutput {
-		fmt.Fprintf(os.Stderr, "%s[WARN] No GitHub webhook secret set. This could allow attackers to spoof requests from GitHub. See https://git.io/vAF3t%s\n", RedTermStart, RedTermEnd)
+		fmt.Fprintf(os.Stderr, "%s[WARN] No GitHub webhook secret set. This could allow attackers to spoof requests from GitHub.%s\n", RedTermStart, RedTermEnd)
 	}
 	if userConfig.GitlabUser != "" && userConfig.GitlabWebHookSecret == "" && !s.SilenceOutput {
-		fmt.Fprintf(os.Stderr, "%s[WARN] No GitLab webhook secret set. This could allow attackers to spoof requests from GitLab. See https://git.io/vAF3t%s\n", RedTermStart, RedTermEnd)
+		fmt.Fprintf(os.Stderr, "%s[WARN] No GitLab webhook secret set. This could allow attackers to spoof requests from GitLab.%s\n", RedTermStart, RedTermEnd)
+	}
+	if userConfig.BitbucketUser != "" && userConfig.BitbucketHostname == DefaultBitbucketHostname && !s.SilenceOutput {
+		fmt.Fprintf(os.Stderr, "%s[WARN] Bitbucket Cloud does not support webhook secrets. This could allow attackers to spoof requests from Bitbucket. Ensure you are whitelisting Bitbucket IPs.%s\n", RedTermStart, RedTermEnd)
 	}
 }
 

runatlantis.io/docs/deployment.md

@@ -184,7 +184,7 @@ Atlantis has right now is any plans that haven't been applied and Atlantis locks
 Atlantis loses that data, you just need to run `atlantis plan` again so it's not the end of the world.
 
 Regardless of whether you choose a Deployment or StatefulSet, first create a Secret with the webhook secret and access token:
-```
+```bash
 echo -n "yourtoken" > token
 echo -n "yoursecret" > webhook-secret
 kubectl create secret generic atlantis-vcs --from-file=token --from-file=webhook-secret
@@ -469,7 +469,7 @@ If you'd like to run Atlantis on [AWS Fargate](https://aws.amazon.com/fargate/)
 
 If you'd like to test out Atlantis before running it on your own repositories you can fork our example repo.
 
-- Fork https://github.com/runatlantis/atlantis-example
+- Fork [https://github.com/runatlantis/atlantis-example](https://github.com/runatlantis/atlantis-example)
 - If you didn't add the Webhook as to your organization add Atlantis as a Webhook to the forked repo (see [Add GitHub Webhook](#add-github-webhook))
 - Now that Atlantis can receive events you should be able to comment on a pull request to trigger Atlantis. Create a pull request
 	- Click **Branches** on your forked repo's homepage

runatlantis.io/docs/security.md

@@ -15,6 +15,20 @@ resource "null_resource" "null" {
 * Running malicious hook commands specified in an `atlantis.yaml` file.
 * Someone adding `atlantis plan/apply` comments on your valid pull requests causing terraform to run when you don't want it to.
 
+## Bitbucket Cloud (bitbucket.org)
+::: danger
+Bitbucket Cloud does not support webhook secrets. This could allow attackers to spoof requests from Bitbucket. Ensure you are whitelisting Bitbucket IPs.
+:::
+Bitbucket Cloud doesn't support webhook secrets. This means that an attacker could
+make fake requests to Atlantis that look like they're coming from Bitbucket.
+
+If you are specifying `--repo-whitelist` then they could only fake requests pertaining
+to those repos so the most damage they could do would be to plan/apply on your
+own repos.
+
+To prevent this, whitelist [Bitbucket's IP addresses](https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html)
+ (see Outbound IPv4 addresses).
+
 ## Mitigations
 ### Don't Use On Public Repos
 Because anyone can comment on public pull requests, even with all the security mitigations available, it's still dangerous to run Atlantis on public repos until Atlantis gets an authentication system.