🪄Code Risk Magic Links

Access finding-specific views and personalized code risk lists through pre-authenticated Arnica links

Summary

Arnica magic links provide access to a code risk finding or a personalized list of findings without requiring sign-in. A magic link can be received in pull request feedback, status checks, and ChatOps notifications, or created from a finding within Arnica.

Availability and configuration

Magic links have settings such as: enable/disable, expiration time, and usage limit. The organization's Arnica Customer Success Manager can be contacted for changing these settings.

Access and permissions

Permissions depend on where the link was created and whether an Arnica session is already active:

• Links from pull requests, the finding Share menu, and the risks mine and risks product commands, provide read-only access when opened without an existing Arnica session.

• Some actionable policy alerts allow the finding status to be changed when dismissal approval is not required.

• For users who are already signed in, the permissions granted to their Arnica account are retained.

Magic links should be treated as sensitive. Anyone who obtains a valid link can access the permitted finding data until the link expires, even without an Arnica account.

Create a link from Arnica

A finding can be shared manually from Risks → Code:

1. The finding is opened.

2. Share is selected.

3. One of the following link types is selected and copied:

   • Magic Link — temporary access is provided without requiring sign-in.

   • Permalink — the link does not expire, and the recipient is required to sign in to Arnica.

In pull request feedback, status checks, ChatOps alerts, and issue-management integrations, the link type is selected automatically by Arnica.

Magic links in pull request feedback

When a magic link is available, View in Arnica will appear in the pull request finding comment, and can be used to open the finding without signing in. This behavior applies to GitHub, Azure DevOps, GitLab, and Bitbucket.

View in Arnica opens the finding without requiring sign-in when a magic link is available.

If a magic link is unavailable, View in Arnica may use a standard Arnica link that requires sign-in. If no Arnica link is available, View in Arnica is omitted from the finding comment.

Status check links

Each finding title displayed in a failed Arnica status-check report is a link. When the title is selected, the destination is determined as follows:

• A pull request comment exists for the finding — the pull request comment is opened in the SCM.

• No pull request comment exists and a magic link is available — the finding is opened in Arnica without requiring sign-in.

• No pull request comment or magic link is available, but a standard Arnica link is available — the finding opens in Arnica and requires sign-in.

• No Arnica link is available — the finding's source file is opened in the SCM.

Finding links in a failed Arnica status check.

Public repositories

To prevent tenant information from being exposed through public pull requests, Arnica handles links according to the repository visibility recorded during the most recent inventory scan:

• Public repositories — Can include magic links when they are enabled and available. These links provide read-only access to the finding without requiring sign-in. Arnica omits the organization identifier from Arnica URLs published in public pull request comments and status checks.

• Private and internal repositories — Magic links retain their standard tenant context.

After changing a repository’s visibility, allow the next inventory scan to complete for Arnica’s pull request links to reflect the change.

Magic links in ChatOps

Code risk alerts

Code risk alerts in Slack and Microsoft Teams can include a magic link to the finding. If the alert does not include a link, the finding can be opened from Arnica or the associated SCM feedback.

Filtered risk lists

When magic links are enabled, the following ChatOps commands return a magic link to a filtered risk list:

• Slack commands — /arnica risks mine or /arnica risks product

• Microsoft Teams (chat with the Arnica bot) — risks mine or risks product

The generated magic link opens:

• risks mine — findings for which the requester is recorded as the author, committer, or pusher.

• risks product — findings associated with products owned by the requester.