Skip to main content

Check code security

Run a scan before a commit or when auditing an existing project to find vulnerabilities, assess their severity, and fix the confirmed issues.

The scan shows the issues it found and the data path to the dangerous operation.

When to use it​

  • after changes made by a developer or by the agent;
  • before a commit or a release;
  • when auditing an existing codebase;
  • when you need to decide which security issues to fix first.

What to prepare​

  • a JVM project in Java or Kotlin;
  • IntelliJ IDEA or Android Studio;
  • a project that can be built in the chosen environment.

Before starting, make sure that building the project is safe in your current environment: the scan begins with a build.

How to run the scan​

  1. In the Explyt chat header, click the shield icon and start the scan.
  2. Wait for the project build and analysis to finish.
  3. Start with the high-severity findings. Open the place in the code and, if a trace is available, review the data path to the dangerous operation.
  4. If the cause is unclear, attach the finding to the chat and ask the agent to explain under which conditions the problem reproduces and what consequences it may have.
  5. If needed, ask the agent to score the vulnerability with CVSS to set its priority.
  6. Do not mark a finding as a false positive until you are sure it does not reproduce in reality.
  7. For a confirmed issue, ask for a fix, review the changes, and run the scan again.

Example prompt:

Analyze this finding. Explain under which conditions it reproduces, what data
travels to the dangerous operation, and what exploitation could lead to.
Do not change code yet. Separate confirmed facts from assumptions.

How to verify the result​

  • run the vulnerability search again;
  • make sure the fixed issue no longer appears;
  • review the changes in Agent Changes;
  • run the related tests and the project build;
  • for an additional check, run Auto Review.

Definition of done​

The scan is complete when every significant finding has been fixed, justifiably marked as a false positive, or handed over to the responsible engineer, and the changes have passed the build and the related tests.

Limitations​

Vulnerability search is supported for Java and Kotlin projects in IntelliJ IDEA and Android Studio. The analysis itself runs offline. If you attach a finding to the chat, your interaction with the agent uses an LLM.