Linear
Proofroom reads Linear’s API with a read-only API key and files two kinds of evidence. Add it on Integrations → Catalogue → Linear → Connect.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Change tickets | window | monthly | Issues in the change teams completed in the window, with when each was created and completed and who moved it to done. Linear has no approvals, so none are assessed. | PCI DSS 6.5.1, 6.5.2; SOC 2 CC8.1 |
| Security issues | window | monthly | Issues carrying the security label created, completed or cancelled in the window, or still open at its end, with priority, state and days open; open ones are counted. Cancelled issues count as resolved. | PCI DSS 6.3.1; SOC 2 CC7.4 (or 12.10.1; CC7.3, CC7.4 when the tickets are incidents) |
Create the API key
In Linear, Settings → Security & access → Personal API keys → New key (admins can always create keys; members only if “Member API keys” is on). Give it Read permission and limit it to the change teams and any team that uses the security label. Proofroom never writes to Linear.
Connect
| Field | Value |
|---|---|
| API key | From above |
| Change teams | Team keys whose completed issues are changes, one per line (ENG) |
| Security label | The label that marks security issues (default security) |
What these tickets are (securityTickets) |
incidents files the security issues against PCI DSS 12.10.1 and SOC 2 CC7.3, CC7.4; vulnerabilities (security bugs) against PCI DSS 6.3.1 and SOC 2 CC7.4 (default vulnerabilities). Changing it moves the collector’s mapping too, unless the mapping was changed by hand. |
Test connection signs in, names any change team the key cannot see, and checks that a label with the security label’s name exists (any case). A security-issues run with no issues also checks the label: if no such label exists, the run fails rather than file “0 security issues”.
Known limits
- Linear has no approval step, so change tickets are not judged approved or not.
- Rate limits are waited out automatically.