Documentation / Security

Security

Local first and deterministic rules. What Yuli protects, what leaves your machine and what you decide.

In Yuli, security boundaries are enforced by the engine on every operation. They don't depend on what the prompt says or on the model “behaving well”. An agent can't get around a rule by talking itself into it.

Local first

The code, the code index, the memory and the agent state live on your machine and in your project. Yuli doesn't need an account or a server of its own to work.

What leaves your machine

What Where to When
AI messages and context To the provider you chose (or to your Claude Code, Kiro, Codex or Antigravity) When you work with the AI. Before anything leaves, secrets are replaced with a placeholder.
The update check To the update server (or to your own Yuli Hub) On startup, if automatic checking is enabled.
Group, artifact and version of your dependencies To OSV.dev Only if you enable that source in the Security Center.
A problem report Only if you choose to send it You build it yourself from Help → Report a problem….

With a local model (Ollama, LM Studio, vLLM or llama.cpp), not even the AI context leaves your network. See Models and providers.

Layers of protection

Layer What it does More information
Project sandbox The agent only creates, moves or deletes files inside the project and the folders you authorize. Sandbox and permissions
Risk-based approvals Every action is evaluated; only risky ones ask for confirmation. Sandbox and permissions
Git and CI only if you ask Commit, push, branches and pipelines are blocked unless explicitly requested. Sandbox and permissions
Secrets .env files and keys are never read; sensitive values go out as a typed placeholder. Secrets and privacy
Prompt injection External content with hidden instructions is treated as data. Secrets and privacy
Database You define the agent's access on each connection. Secure database
Security analysis Dependencies, code, leaks and race conditions, offline. Security Center
Quality gate Rejects secrets and test cheats on every commit. Gate and Governance Center

What the agent never does

  • Read environment files, private keys, certificates or SSH configuration.
  • Commit, push, merge or create branches without you asking.
  • Run statements that write to a database without your approval, nor in unattended mode.
  • Use command-line database clients (sqlplus, sqlcmd, mysql, psql, mongosh and the like). That way nobody bypasses the access policy.
  • Sign a commit as the author or add AI attribution. The author is always the person responsible.

What you decide

  • Autonomy: how much the agent can do without asking (Cautious, Balanced or Autonomous).
  • Folder access: which folders outside the project it can use, and whether it can only read them.
  • Project trust: whether code from the repository is executed to analyze it.
  • Access to each database: no access, queries only or super permissions.
  • Trusted servers: internal servers with their own certificates, always with your confirmation.

Credentials

API keys, database passwords and Git, CI and MCP tokens are stored in the system keychain: the native Windows store, the macOS Keychain or Secret Service on Linux. Never in the project. On screen they always appear masked.

Plugins

Plugins run in isolation: a failure doesn't affect the IDE. They declare their permissions in a manifest, network access only reaches declared domains and the team can require a digital signature.

Report a problem

Help → Report a problem… builds a .zip in your downloads folder with the versions, the system, the error logs and the latest requests to the engine (without parameters).

The report never includes your code or your conversations with the agent. Keys, tokens and passwords are redacted, and your home folder appears as ~.