security-review

To run a security review on a Juju charm, execute the security-review task on your build to surface common vulnerabilities before finishing. It automates checks for shell injection, path traversal, and credential handling directly in your development workflow.

A charm security review checks for common vulnerabilities including shell injection, path traversal, credentials handling, SSRF, broad exception handling, and logging hygiene. It classifies these findings by risk level and provides clear remediation guidance.

Yes, you can integrate automated security checks into charm CI pipelines to prevent insecure charms from being released. The security review task validates code, shell interactions, and configuration data during the build process.

Yes, the security review covers Python code, shell interactions, and configuration data in charms. It identifies common pitfalls in shell usage, path handling, and data handling to ensure secure charm development.

Security findings for charm builds are classified by risk level with clear remediation guidance surfaced to the user. This structured approach provides actionable fixes for identified issues before the build task completes.

You need to perform a pre-build security review for Juju charms when development introduces potential security issues during BUILD tasks. This catches common charm-specific vulnerabilities early in manual builds or CI pipelines.