#vulnerable code 
                                private Mapper retrieveModel(TypeElement element) {
        //1.) build up "source" model
        List<Method> methods = retrieveMethods( element, true );

        //2.) build up aggregated "target" model
        List<BeanMapping> mappings = getMappings(
            methods,
            ReportingPolicy.valueOf( MapperPrism.getInstanceOn( element ).unmappedTargetPolicy() )
        );
        List<Type> usedMapperTypes = getUsedMapperTypes( element );

        Mapper mapper = new Mapper(
            elementUtils.getPackageOf( element ).getQualifiedName().toString(),
            element.getSimpleName().toString(),
            element.getSimpleName() + IMPLEMENTATION_SUFFIX,
            mappings,
            usedMapperTypes,
            options
        );

        return mapper;
    } 
                            #location 8 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                private Mapper retrieveModel(TypeElement element) {
        //1.) build up "source" model
        List<Method> methods = retrieveMethods( element, true );

        //2.) build up aggregated "target" model
        List<BeanMapping> mappings = getMappings(
            methods,
            getEffectiveUnmappedTargetPolicy( element )
        );
        List<Type> usedMapperTypes = getUsedMapperTypes( element );

        Mapper mapper = new Mapper(
            elementUtils.getPackageOf( element ).getQualifiedName().toString(),
            element.getSimpleName().toString(),
            element.getSimpleName() + IMPLEMENTATION_SUFFIX,
            mappings,
            usedMapperTypes,
            options
        );

        return mapper;
    }