Atlassian Rovo

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

• Merges PRs, commits and runs Bitbucket pipelines; releases versions: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
• Permanent deletion of Jira work items, comments, attachments: Can delete records, files, projects, messages, or resources that may be difficult to recover.
• Can change persistent data or access: Can create or change persistent records, files, projects, permissions, settings, or credentials.
• Posts comments and shares content as the user: Can send messages, comments, invitations, posts, or published content attributed to the connected user.
• Consumes Rovo credits for AI-generated visuals: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.