Bitbucket Cloud visibility toggle audit log gaps

Direct answer

No, Bitbucket Cloud does not provide a native way to enable visibility‑change tracking in the workspace audit log, and there is no workspace‑level policy that can stop any administrator from setting a repository to public.

Confirmed facts

• The standard audit log does not contain entries for repository visibility toggles.
• No built‑in workspace setting exists to block the "make public" action for repo admins.

Likely explanation

Visibility changes are treated as ordinary repository updates; the audit log only records events that are explicitly mapped to audit‑log categories, and the visibility flag is not among those categories. Consequently, the event is omitted unless a custom mechanism is used to capture it.

Steps to detect visibility changes

1. Set up a workspace webhook for the repo:updated event (or repo:visibility_changed if it becomes available). In the webhook payload, inspect the visibility field to see if it changed from private to public.
2. Periodically poll the repository API to compare the current visibility with a stored baseline. Example using curl:

   # Get current visibility
   curl -s -u "$BITBUCKET_USERNAME:$BITBUCKET_APP_PASSWORD" \
     "https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG" \
     | jq -r '.visibility'
   

3. Log the result in your SIEM or a simple storage service and alert on any transition to public.

Steps to restrict new repositories (partial mitigation)

1. Go to Workspace Settings → Repository creation restrictions.
2. Enable the option "Allow only private repositories" – this forces newly created repos to be private, but it does not affect existing repositories.

Missing diagnostic detail

To determine whether any advanced audit‑log features are available for your workspace, please confirm your Bitbucket Cloud plan (e.g., Standard, Premium). The availability of extended audit‑log queries may change the recommendation.