Skip to main content

​
Linear Integration

The Linear integration is currently in beta. To request access for your team, contact support@corridor.dev.
Corridor integrates with Linear to create tracked issues from security findings. When Corridor reviews a pull request (GitHub) or merge request (GitLab) and publishes a finding, it creates a Linear issue in the team you choose, with the finding’s severity, affected code, and a link back to Corridor.

​
What you get

  • Automatic issues: Every finding Corridor publishes on a pull request or merge request review becomes a Linear issue
  • One issue per finding: Corridor creates a single issue for each finding
  • Linked in both directions: GitHub review comments include the Linear issue identifier, and the Corridor dashboard links each finding to its issue
  • False positive handling: When a finding is marked as a false positive, the issue is labeled and the reasoning is added as a comment

​
Connecting Linear

You need to be a Corridor team admin to set up the Linear integration, and you need permission to authorize applications in your Linear workspace. Linear ticketing is available on the Enterprise plan.
1

Open your team settings

In the Corridor dashboard, go to your Team page and find the Integrations section.
2

Add the integration

Click Add Integration and select Linear, then click Connect with Linear.
3

Authorize Corridor

A Linear window opens asking you to authorize Corridor for your workspace. Review the permissions and click Authorize. Corridor requests permission to create issues, add labels, and post comments.
4

Configure ticketing

Back on the Integrations section, click Configure Ticketing on the Linear integration to open the configuration dialog.

​
Ticketing settings

The Configure Linear Ticketing dialog has four settings:
Both label settings list labels that already exist in your Linear workspace. Labels can’t be created from Corridor—to use a new label, create it in Linear first, then reopen the dialog.
Click Save. Issues are created starting with the next review that publishes a finding. Each Corridor team connects to one Linear workspace. To change the destination team or labels later, return to Configure Ticketing on your Team page.

​
Reconnecting Linear

Linear access tokens expire. Corridor refreshes them automatically in the background, so a healthy connection keeps working without any action from you. If a refresh fails—for example, the connection was revoked in Linear, or it was first connected before token refresh was supported—Linear-backed features stop working and Corridor surfaces a connection expired message. When this happens, the Configure Ticketing dialog can’t load teams or labels, and ticket creation pauses until you reconnect. To restore the connection:
1

Open the Integrations section

On your Team page, find the Linear integration row in the Integrations section.
2

Click Reconnect

Click Reconnect (team admins only) and complete the Linear authorization. This re-runs the OAuth flow and updates the existing integration in place—your webhook and ticketing settings are preserved.
Use Reconnect rather than deleting and re-adding the integration. Deleting it wipes your ticketing configuration and breaks the registered Linear webhook.
Reconnecting to the same Linear workspace keeps your ticketing configuration. If you reconnect to a different workspace, Corridor clears the destination team and label settings—those IDs belong to the old workspace—so you’ll need to reconfigure ticketing afterward.

​
What’s on each issue

When Corridor publishes a finding on a review, the Linear issue includes:
  • Title: The finding’s severity and title, prefixed with [Corridor]. For example, [Corridor] High: SQL injection in user search endpoint
  • Priority: Mapped from the finding’s severity—Critical → Urgent, High → High, Medium → Medium, Low → Low. Findings with no severity use the Linear team’s default priority
  • Severity, CWE, and affected file (with line number) at the top of the description
  • GitHub author: For GitHub findings, the pull request author’s username
  • Description: Corridor’s explanation of the vulnerability
  • Code: The affected code snippet
  • Links: A link to the finding in the Corridor dashboard and, for GitHub findings, a link to the pull request
  • Label: The findings label, if you configured one
When the destination Linear team has Triage enabled, Corridor creates issues directly in the Triage state, so they land in your team’s triage queue instead of the backlog. If Triage isn’t enabled, issues use the team’s default workflow state.

​
Where issues are linked

  • GitHub review comments: Corridor’s PR review comment includes a link to the issue (for example, tracked in Linear (ENG-142))
  • Corridor dashboard: Each finding with an issue shows a View in Linear link in the finding details and the code view

​
Issue updates

After an issue is created, Corridor posts updates as the finding changes:
  • False positives: When a finding is marked as a false positive from the Corridor dashboard, a reply to the GitHub PR comment, or the IDE, Corridor adds the false positive label to the issue and posts a comment with the reviewer’s reasoning and Corridor’s own analysis
  • PR conversations: When a developer discusses the finding in the GitHub PR comment thread, the developer’s comment and Corridor’s reply are added to the issue as comments
  • Corridor’s analysis: When Corridor finishes evaluating a false positive claim, the verdict and reasoning are posted as a comment, whether it confirms the false positive or concludes the issue is valid

​
Good to know

  • Issues are not closed automatically when a finding is fixed or closed in Corridor
  • Changes made in Linear (closing the issue, editing it, changing labels) don’t affect the finding in Corridor
  • Issues are only created for findings published after you enable ticketing. Existing findings are not backfilled

​
GitLab differences

Issues are created for GitLab merge request findings in the same way, with a few differences during the beta:
  • Merge request comments don’t include the Linear issue link. Use View in Linear in the Corridor dashboard instead
  • Issues don’t include a link back to the merge request, or the GitHub author line (it’s specific to GitHub pull requests). Priority and Triage placement work the same as for GitHub findings
  • Merge request comment threads aren’t mirrored onto the issue, and replying to an MR comment doesn’t mark a false positive. Marking a finding as a false positive from the Corridor dashboard or the IDE still labels and updates the issue

​
Troubleshooting

​
Issues aren’t being created

  1. Verify Enabled is turned on and a Destination Linear team is selected in Configure Ticketing
  2. Issues are only created when a review publishes a finding—clean reviews don’t create issues
  3. Corridor creates one issue per finding, so a finding that already has a Linear issue won’t get a second one

​
The false positive label isn’t applied

  1. Confirm a False positive label is selected in Configure Ticketing
  2. The label is added when the finding is marked as a false positive, not when the issue is created

​
Teams and labels won’t load, or tickets stopped being created

If the Configure Ticketing dialog reports that the connection has expired, or the team and label menus fail to load, the Linear connection needs to be re-authorized. Click Reconnect on the Linear integration row—see Reconnecting Linear. Still stuck? Contact support@corridor.dev.