Gap Hunter Labs
Work with Joel

Gap Hunter Labs · independent engineering practice

I trace performance bottlenecks, security vulnerabilities and structural failures to their root cause, and I ship the fix.

Gap Hunter Labs is the engineering practice of Joel Díaz. I analyze complex systems, audit codebases and investigate performance bottlenecks, critical security vulnerabilities (CVEs) and structural failures in developer tools, enterprise platforms and open-source ecosystems. I follow each problem to its root cause and ship the precise fix that removes it: from upstream reports and patches to specialized tools and tailored audits. Every finding and fix published here is backed by verifiable technical evidence: tickets, pull requests, tests and a direct trail to the source.

Read the investigations Discuss an engagement

Work

Selected investigations

Performance, security, reliability, static analysis and third-party audits. Status as of October 19, 2026. Performance measurements were taken on IntelliJ IDEA 2026.2.3, with each test attached to its ticket; security findings were checked against OSV for the exact pinned version. The fixes sent to JetBrains are open pull requests awaiting review.

No. 01 · Performance

IJPL-257909

IntelliJ Platform · Settings › Plugins · UI thread

Pull request #3701 · open, awaiting review

Opening Settings › Plugins took most of a second

Cause
For each installed plugin, the page rebuilt the plugin and module maps and walked the dependencies of every essential plugin, on the UI thread. The cost grows with the square of the number of installed plugins, and the source code already had a FIXME about it.
Intervention
Compute the set of plugins that essential plugins require once per plugin set, then look each plugin up in it. The cache is dropped when the plugin set is replaced.
Result
With 158 plugins loaded, the page took 689–931 ms to open. One walk plus a lookup per plugin takes 8–22 ms and gives the same answer for all 158.

Ticket and measurement testPull request #3701

No. 02 · Security

reactive-commons-go#5

Bancolombia · Go messaging library · dependencies

Fixed by the maintainers · October 7, 2026

A messaging library pinned to a dependency with three critical advisories

Cause
The library’s go.mod pinned github.com/rabbitmq/amqp091-go at v1.10.0, inside the affected range of 10 advisories published in September 2026: 3 critical (a missing TLS minimum version in the URI parser, frame injection through an integer overflow, and silent truncation of short strings) and 7 high.
Intervention
A report to the maintainers with every advisory checked against OSV for the exact pinned version, and the version that fixes all of them (v1.13.0).
Result
From 10 advisories to 0 in OSV: the maintainers upgraded to v1.15.0 in pull request #6 and closed the report 3 days after it was filed.

ReportPull request #6All security reports

No. 03 · Third-party audit

lsp4ij#1540

Red Hat · LSP4IJ plugin · UI thread

Fixed by the maintainer · October 9, 2026

A language-server client detecting file types on the UI thread

Cause
LSPBreadcrumbsRefreshListener.breadcrumbsChanged() runs on the UI thread and requested document symbols there, which reaches file-type detection that can read the file content. The issue had been open since May 2026.
Intervention
A report to the maintainer with the exact path in the current code and a suggested fix: run the request on a pooled thread and keep only the restart on the UI thread.
Outcome
The maintainer made that change the same day and closed the issue. Impact, stated plainly: one slow call per open file each time a language server starts.

Issue #1540Commit f38259550eAll third-party audits

No. 04 · Reliability

IJPL-200871

IntelliJ Platform · workspace model · concurrency

Fixed by JetBrains · September 9, 2026

A ConcurrentModificationException in the workspace model

Cause
WorkspaceFileIndexDataImpl.fillPackageFilesAndDirectories() iterates an unsynchronized LinkedHashMap that can change in the middle of the iteration.
Intervention
Root-cause analysis posted on the ticket. It located that iteration and proposed a ProgressManager.checkCanceled() call.
Outcome
JetBrains fixed the ticket with a different change: the package-name queries now bring the index up to date before reading it.

Ticket and analysisCommit e1d600df

No. 05 · Static analysis

IDEA-393501

IntelliJ IDEA · Java › Tests · read actions

Filed · assigned to a JetBrains developer, open

A freeze pattern inside IntelliJ’s own test search

Cause
SearchForTestsTask runs in the background but calls onFound() through the blocking ReadAction.run(), with no checkCanceled() anywhere in the class. JetBrains’ Platform Blog names this pattern as a recurring cause of UI freezes.
Intervention
Found by Background ReadAction Freeze Companion, a static check for this pattern. A follow-up showed why a plain switch to a non-blocking read action is not safe here: onFound() writes files, and a restarted read action would write them again.
Outcome
JetBrains moved the ticket to the IDEA project and assigned it to a developer. Both calls are still on master as of October 2026.

Ticket and follow-upThe plugin that found it

Also on record

  • Fixed async-dataflow#148: high-severity advisories in direct dependencies of a real-time delivery service, cowboy, cowlib and plug. The maintainers also found plug_cowboy, which the report had missed, and upgraded all of them in pull request #149, merged on October 16, 2026.
  • Open IJPL-257908: Live Templates settings compared 1,295 templates against 336 context types on the UI thread after every key press. A one-line fast path, sent as pull request #3694, takes the comparison from 157 ms to 0 ms.
  • Open Root-cause analysis on existing IntelliJ Platform tickets: a memory leak through ProjectRootManagerImpl (IJPL-196254) and a stack overflow that silently empties Git Log (IJPL-76141).
  • Open IJPL-223452: a headless reproduction of slow typing in a large Java file with the Structure view open, a median of 1,080 ms per key press against 33 ms without it.
  • Open Three Java inspection changes sent as pull requests (#3697, #3698 and #3699): two new inspections, and an extension of an existing one that a JetBrains maintainer had asked for.

All JetBrains Platform ticketsOpen-source security reportsPlugin case studies

Engineering

How an investigation runs

The same method applies to a slow IDE, a vulnerable dependency and a crash in a platform tracker.

  1. 01

    Find the gap

    Start from evidence someone can point to: a freeze report, a published advisory, a crash in a tracker, a check that no tool makes. Reproduce it on the exact version where it happens.

  2. 02

    Understand the cause

    Follow it to the code that causes it: the method that spends the time, the dependency version inside an advisory’s affected range, the iteration that is not synchronized. Keep the reproduction as a test or a check that anyone can run again.

  3. 03

    Build the fix

    Ship the smallest change that removes the cause, with evidence before and after: a pull request upstream, a report to the maintainers, or a plugin when the fix belongs outside the platform.

Read the methodologyAll engineering evidence

Services

Engagements

Published prices in USD, per engagement. The written scope, agreed before any work starts, confirms which level applies. Written deliverables, async by default.

EngagementWhat you getTerms
Plugin performance audit For plugins with reports of UI freezes, typing lag or high CPU: reproduction on each IDE version you support, measurements on the UI thread, a code review for freeze patterns, and patches with before-and-after measurements. USD 10,500 · one plugin, up to 3 IDE versions · 10 business days
Extended: USD 15,000 · 15 business days
Plugin updates for new IDE versions Your plugin built and verified against the IntelliJ versions you need to support: removed or deprecated APIs, Kotlin K2 mode, IntelliJ Platform Gradle Plugin 2.x and Plugin Verifier failures. Minor: USD 4,500 · 5 business days
Major: USD 9,000 · 10 business days
Custom plugins and inspections Inspections tailored to your codebase, such as internal APIs, secret formats and security patterns, delivered as a plugin your team installs. The same checks can run in GitHub Actions or GitLab CI. Up to 3 inspections: USD 7,500 · 10 business days
Full plugin with CI: from USD 15,000
Dependency and CI/CD security review A read-only review of the repositories you choose: known vulnerabilities in production dependencies, dependency-confusion risks and CI/CD workflow permissions. Optional EU Cyber Resilience Act readiness check. One repository: USD 4,800 · 5 business days
Up to 5 repositories: USD 12,000 · 10 business days
CRA readiness: + USD 1,500 · + 2 business days

How to start

  1. Email gaphunterlabs@gmail.com or use the contact page. Tell me the plugin or repository and what you need.
  2. You get the scope, delivery date and price in writing before any work starts.
  3. The work arrives in writing: a report, and a pull request when there is code to change.
Start a conversation See all services

About

Joel Díaz, Founder. Trained in systems engineering, with a background in industrial operations and logistics. Today I build software under a strict operating principle: rigorous quality control, full traceability, and validation based on real-world data.

Fixed scope · written deliverables · async by default · UTC−5
Open to consulting engagements and select opportunities.

LinkedInGitHubXRSS

Tools

Selected tools

Some gaps are better closed outside the platform. Each of these plugins started from one documented gap.

Background ReadAction Freeze Companion

JetBrains IDEs · Free

Gap
The freeze pattern that JetBrains’ Platform Blog names, a background task that reaches a blocking, non-cancellable read action, had no static check.
Fix
An inspection for your plugin’s own code. The same check found IDEA-393501 in IntelliJ itself.

OpenAPI Companion

JetBrains IDEs · Paid

Gap
Reviews of existing OpenAPI plugins report external $ref values that do not resolve, or editors that freeze the IDE on large specs.
Fix
$ref navigation resolved entirely against local files, and a warning on every $ref that does not resolve.

Ansible Companion

JetBrains IDEs · Freemium

Gap
Working with Ansible Vault files in the IDE depended on the ansible-vault command being installed.
Fix
Encrypt and decrypt Ansible Vault (1.1, AES256) directly in the editor.

Mermaid Companion

JetBrains IDEs · Freemium

Gap
Reviews of existing Mermaid tooling for JetBrains IDEs report false warnings and errors on valid diagrams, such as identifiers with non-ASCII characters.
Fix
Syntax highlighting and syntax validation for .mmd and .mermaid files: flowchart, sequence and class diagrams.

Catalog

The full catalog

146 JetBrains plugins and 33 VS Code extensions, each with its own page and a clear price: free, freemium or paid. Figures are synced twice a day from public JetBrains Marketplace and GitHub data (last snapshot: 2026-10-18).

Open the catalog Paid and Pro plugins