# Bitbucket Rovo Dev Auto Closing Vulnerabilities

Source: https://www.youtube.com/watch?v=LEs4M1CFSEU
Recap page: https://rapidrecap.app/video/LEs4M1CFSEU
Generated: 2025-12-18T23:05:28.395+00:00

---
## Quick Overview

Atlassian's Rovo Dev agent automatically resolves code vulnerabilities by creating, fixing, validating, and merging pull requests, resulting in saving over 1000 developer hours and reducing vulnerability resolution time by 50% across 1800 merged PRs in a three-month pilot.

**Key Points:**
- The Rovo Dev agent was launched to automatically resolve vulnerability (VULN) issues identified through Software Composition Analysis (SCA) scans in Bitbucket Cloud.
- The pilot program resulted in over 1000 developer hours saved and a 50% reduction in vulnerability resolution time over three months.
- The automation processed 1800 merged Pull Requests (PRs) that addressed vulnerabilities.
- The automated workflow starts with a Jira issue, utilizes Rovo Dev to clone the repository, confirm the vulnerability, gather context, fix the issue, validate, iterate, and finally prepare and raise the PR for review.
- The PR generated by Rovo Dev includes a comprehensive summary of changes, including dependency updates (e.g., upgrading Spring Framework dependencies) and updated CVE references.
- Verification steps confirm the vulnerability is no longer detected, the dependency tree is updated to fixed versions (e.g., Spring Framework core to 6.2.11), and all build pipelines passed successfully.
- The presentation concludes by encouraging users to try Rovo Dev, noting that more sophisticated agent features are planned for future launches.

![Screenshot at 01:07: The introduction slide detailing the impacts of automatic vulnerability resolution, showing key metrics: 1800 Merged PRs, \>1000 Dev hours saved, and -50% Resolution time.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-01-07.png)

**Context:** Ray Zhang, a Principal Machine Learning Engineer at Atlassian, presents a 'Bitbucket Blitz' session detailing the implementation and impact of the Rovo Dev agent for automatic vulnerability resolution. The context is addressing the overwhelming challenge of handling over 1000 new SCA issues per month, which previously consumed over 1000 developer hours monthly and took more than 10 days to resolve traditionally.

## Detailed Analysis

The presentation details how Atlassian leveraged Rovo Dev to tackle the significant challenge of managing a massive backlog of security vulnerabilities identified via Software Composition Analysis (SCA), which historically consumed over 1000 developer hours per month and took over 10 days to resolve. The solution involves the Rovo Dev agent automating the entire remediation lifecycle triggered by a Jira issue. The process flow includes the agent cloning the repository, confirming the vulnerability using the same scanner, gathering context and requirements, fixing the issue via iteration (Fix, validate, iterate), performing final touch-ups, preparing the Pull Request (PR) with appropriate summaries and reviewers, and finally merging the fix. In a three-month pilot, this automation led to significant gains: 1800 vulnerabilities were resolved via merged PRs, saving over 1000 developer hours, and cutting the vulnerability resolution time by 50%. The PR generated by the bot is highly detailed, including summaries of dependency changes (like upgrading Spring Framework core from 6.2.10 to 6.2.11) and updated CVE references. Verification steps confirmed the fix, showing successful builds and verification trees confirming the removal of the vulnerability.

### Vulnerability/SCA Challenge

- >1000 Issues/month
- >1000 Dev hours/month
- >10 Days to resolve
- Teams struggle to address issues while delivering features

### Impacts of Automatic VULN Resolution

- 1800 Merged PRs
- >1000 Dev hours saved
- -50% Resolution time
- Reduced company exposure to vulnerabilities

### How We Built with Rovo Dev?

- Jira issue triggers Rovo Dev
- Clone repo & Confirm VULN issue
- Gather context & additional requirement
- Fix, validate, iterate
- Final touch up & PR preparation
- PR raised and merged after review

![Screenshot at 00:04: Title slide introducing the topic: Automatic Vulnerability Resolution with Rovo Dev, presented by Ray Zhang.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-00-04.png)
![Screenshot at 00:24: Slide quantifying the challenge: over 1000 issues/month require over 1000 developer hours/month, taking \>10 days to resolve.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-00-24.png)
![Screenshot at 01:07: Slide summarizing the results: 1800 Merged PRs, \>1000 Developer hours saved, and -50% Resolution time achieved through Rovo Dev automation.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-01-07.png)
![Screenshot at 01:46: Diagram illustrating the automated workflow triggered by a Jira issue, moving through Rovo Dev processing, cloning, confirmation, fixing, and PR preparation.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-01-46.png)
![Screenshot at 03:33: Example of a Bitbucket issue detailing a vulnerability in org.springframework.framework:core@6.2.10, showing paths where the vulnerable dependency was found.](https://ss.rapidrecap.app/screens/LEs4M1CFSEU/00-03-33.png)