Documentation / Security

Security Center

Local analysis of dependencies, code, memory leaks and race conditions, without sending your code anywhere.

The Security Center runs a local analysis of the project, without sending your code anywhere. Online sources and AI review are optional and enabled separately.

How to open it

  • Right rail → More tools → Security Center (“Findings and secrets”).
  • Command palette (Ctrl+Shift+A): Security Center (vulnerabilities, leaks, races).
  • From the Prevention tab of the Quality panel.

Click Scan project the first time and Scan again after making changes.

Tabs

Tab What it shows
Overview The overall status and the most important findings.
Dependencies Libraries with known vulnerabilities or no longer supported.
Code Vulnerabilities in the project's code.
Memory and concurrency Resource leaks and race conditions.
Licenses Dependency licenses.
AI review An optional analysis with the model, which you enable with AI review.

Dependencies

Vulnerability sources

Under Options → Vulnerability sources:

Source Status What it sends
Yuli local database Always on Nothing. Works offline, with known CVEs for common Java libraries (Struts, Log4j, commons, Spring, Jackson…), unsupported components and licenses.
OSV.dev Off by default Only the group, artifact and version of each dependency.
OWASP Dependency-Check Optional Uses a local installation.

With only the local database, the analysis is fully offline. Enable OSV.dev if you also want to query GitHub Advisory and NVD.

Scope

  • Include test code.
  • Include server jars.

Code

Code analysis covers Java, JSP, web.xml and Hibernate descriptors.

Category Examples
Injection SQL built from request data.
XSS Unescaped output in JSP or servlets.
Insecure deserialization Objects read from untrusted sources.
XXE Unprotected XML parsers.
Weak cryptography Obsolete algorithms.
TLS Managers that trust any certificate.
Open redirects Destinations taken from the request.
Secrets Credentials hardcoded in the code or printed in logs.

A per-method taint model follows values coming from the request (getParameter, getHeader, cookies) and from Struts ActionForms. When a finding receives user data, its confidence and severity go up.

Memory and concurrency

Leaks

  • Unclosed JDBC connections or streams.
  • ThreadLocal without remove().
  • Static caches that grow without limit.
  • Threads that never stop.

Race conditions

  • Shared state in Servlets, Struts Actions and singletons.
  • Static SimpleDateFormat.
  • Double-checked locking.
  • Check-then-act patterns.

To confirm a leak at runtime, use the JVM panel: a repeated memory histogram shows which classes are growing. See Run and debug.

Where reports are stored

In the project's .yuli/security/ folder, which Yuli excludes from Git.

Prevention in the editor

In addition to the Security Center, Yuli checks every file live as you type and after each agent edit: OWASP Top 10, CWE, performance, robustness and accessibility. Findings appear underlined with their reference and how to fix them. See Measurement against N−1.

SBOM and supply chain

The software bill of materials (SBOM) is generated in the Governance Center, Supply chain tab, with Write SBOM. Formats: CycloneDX 1.5 JSON and SPDX 2.3 JSON. See Gate and Governance Center.

With the agent

The agent can query the Security Center with the yuli_security_center and yuli_security_scan tools, and propose fixes that go through the changes window like any other.