Skip to main content

Vulnerability search

Explyt can check the security of the whole project and find vulnerabilities in the codebase. You can attach the findings to a chat: the agent will help you fix the code, check whether a finding is valid, or work out which findings need action.

How to start​

Open an empty Explyt chat and select vulnerability search in the action catalog. The plugin builds the project if needed and then runs the analysis.

How the analysis works​

The scan uses Explyt's own static analysis engine. It works on compiled sources. If no class files are available, the plugin picks a suitable build strategy: Maven, Gradle, or a build performed by the IDE.

The engine performs interprocedural analysis: it tracks how data flows through functions and methods, from the point where it appears (source) to the point where its use could cause a problem (sink). This sets it apart from most tools, which look for vulnerabilities only within a single function.

After a successful analysis, a results panel opens. Choose a grouping based on how you plan to work through the report.

By severity​

Use this grouping for the first pass over a large report. Start with the most dangerous findings, check their traces, and calculate a CVSS score if needed. Then fix the confirmed vulnerabilities or mark the false positives.

By files and folders​

Use this grouping when you want to work through the results component by component. Open a folder or a file, check the related findings, and pass them to the component owner or attach them to a chat to fix them in the context of that piece of code.

By category​

Use this grouping when you need to find a recurring class of issues across the whole project, for example SQL injections, XSS, or SSRF. Compare the traces of findings in the same category, identify the shared unsafe pattern, and fix it everywhere it occurs.

Many vulnerabilities come with a trace: it shows where the data comes from and how it flows through the code from the source to the dangerous point. Click a trace step to highlight the matching location in the editor.

Actions for found vulnerabilities​

For each vulnerability, the following actions are available:

  • Fix — the agent reads the vulnerable code and suggests changes that eliminate the issue.
  • Attach to chat — send the vulnerability to the agent to discuss it: how it works, how to reproduce it, or ask for an explanation in plain language if you are not a security expert.
  • Mark as false positive — if you are sure the finding does not reproduce in reality, click the exclamation mark button. The vulnerability disappears from the results list.
  • Evaluate CVSS score — assess the severity of the vulnerability.

Severity assessment​

You can attach a vulnerability to a chat and ask the agent to calculate a CVSS score. The agent determines the factor values, passes them to the calculator, and explains the result.

CVSS is a numerical score from 0 to 10. A score of 0 means the vulnerability is not reproducible; a score of 10 means exploitation could cause critical damage (data leaks, financial loss, infrastructure destruction).

After the calculation, the CVSS score appears next to the vulnerability in the results panel.

False positives are one of the main problems with security tools. Security professionals spend up to 90% of their time checking findings that turn out to be non-issues. CVSS scoring helps separate real problems from false ones faster.

IDE support​

Vulnerability search works for JVM projects in IntelliJ IDEA and Android Studio — that is, for Java and Kotlin. We are working on expanding support to other languages and IDEs.

The analysis runs fully offline: your code is never sent anywhere, and no server connection is required. The only exception is interaction with the agent, which uses an LLM.

New vulnerability types are added with plugin updates: the engine operates on a set of rules that ships with each update. Custom rules cannot be added yet, but in the future the agent will be able to write rules tailored to your project automatically.

When to use it​

  • Checking AI-generated code. An LLM can inevitably write code with vulnerabilities. Targeted attacks are also possible: attackers study the behavior of the specific LLM a company uses and plant prompt injections that push the model into generating vulnerable code. Vulnerability search helps catch critical security issues before committing.
  • Auditing an existing codebase. Any team lead can run a scan across the entire repository, see the security issues, and fix them quickly, for example by making a pull request that eliminates the critical vulnerabilities.
  • When you need to quickly decide which findings to fix first.