Plugins para JetBrains y VS Code que resuelven brechas reales

Syntax highlighting and real syntax validation for .mmd/.mermaid diagram source files (flowchart, sequence, and class diagrams).

Run React Native commands (run-android, run-ios, Metro) from a tool window without freezing the IDE.

Encrypt and decrypt Ansible Vault (1.1/AES256 format) directly in the editor, without depending on ansible-vault being installed.

Lightweight, 100% local API-security checks for Java and Kotlin: hardcoded secrets, plaintext HTTP, TLS misconfiguration, and OWASP API Security Top 10 patterns.

Static syntax and structural checks for .gitlab-ci.yml: catch mistakes before running a real pipeline, not after.

Reliable go-to-definition (Ctrl+Click / Ctrl+B) for $ref values in OpenAPI/Swagger specs written in JSON or YAML, resolved entirely against local files, plus a warning on any $ref that doesn't actually resolve.

Decode and verify JSON Web Tokens directly in a dedicated tool window: no browser round-trip, no data leaving the IDE.

A native, client-side viewer for X.509 certificates and keystores: decode a .pem, .crt, .cer, .der, .jks, .p12, or .pfx file without leaving the IDE.

Preview every refactoring before committing it. Simulates a rename in an isolated, in-memory sandbox (using IntelliJ's own PSI, Find Usages, and refactoring processors, never a custom engine) and shows a full impact report, deterministic validation, and a native side-by-side diff before anything touches a real file.

Flags known-vulnerable dependency versions directly in pom.xml, build.gradle(.kts), package.json, and requirements.txt, matched against a vulnerability database bundled inside the plugin: zero account, zero token, zero network call, ever.

Go-to-definition and a real structure tree for XSD/WSDL schemas split across multiple files.

Browse and edit Firestore collections, documents, and subcollections in a tool window, authenticating with a GCP service account key via simple REST calls.

Flags SQL queries built by unparameterized string concatenation or interpolation (the classic SQL-injection shape) across Java, Kotlin, and Python, and offers a real quick-fix toward parameterization. Deliberately narrow (not a full SAST scanner like Qodana): one specific pattern, near-zero configuration, tuned hard against false positives.

Reliable go-to-definition for $ref values in AsyncAPI documents (JSON and YAML): 100% local, no network calls, and it never breaks when a new JetBrains IDE version ships.

Gutter icon on every entry of an open package.json's "scripts" section, showing whether that script is actually referenced anywhere in your project: or an orphan nobody calls, a real candidate for cleanup. 100% static text/PSI analysis of files already open in your project: no Node.js/npm process spawned, no network call.

Gutter icon per "scripts" entry of an open composer.json, showing whether it's used or an orphan candidate: checks the script's own composer.json (calling another script), GitHub Actions/GitLab CI/ CircleCI configs, and README.md for a real composer run-script <name> or composer <name> invocation.

Go-to-definition (Ctrl+Click) for $ref values inside JSON Schema files, resolved entirely against local files.

A cognitive-complexity gutter icon for Java and Kotlin methods/functions: a colored badge with the real number, computed with SonarSource's documented Cognitive Complexity algorithm, never blocking the UI thread.

Real Groovy syntax highlighting for Jenkinsfile plus two genuine structural checks: 100% local, zero network calls, never a live Jenkins server connection.

A Run Configuration for k6 load test scripts, plus a tool window for k6's --summary-export JSON.

Run Check Import Sizes on a JS/TS file and get a real report of every node_modules package it imports, sorted by on-disk size, with unusually large ones flagged.

Shows the real, on-disk size of each COPY/ADD layer in an open Dockerfile, inline: computed by summing the actual file sizes of what gets copied from your local build context, respecting .dockerignore. No Docker daemon, no build, no network call: 100% static analysis of the project already open in the IDE.

Warning icon on any Java/Kotlin metric name literal that violates Prometheus's own documented naming conventions (prometheus.io/docs/practices/naming): recognizes the two most common real registration shapes: the Prometheus Java client's Counter.build("name", "help") and Micrometer's Counter.builder("name") (same for Gauge/Histogram/Summary/Timer).

Syntax highlighting, known-command highlighting, and an unmatched-paren inspection for CMakeLists.txt/*.cmake files.

Edit CSV/TSV files in a real table and view XLSX workbooks: without leaving the IDE, and without the plugin taking over your files.

Converts JSON, YAML, and XML directly in the editor: select text (or convert the whole file) and pick a target format from the right-click menu.

Warning icon on any Java/Kotlin Spring CORS configuration that combines a wildcard origin with credentials: this exact combination is forbidden by the CORS spec itself: browsers reject a wildcard origin combined with credentials, so requests silently fail (or, worse, the intent behind the configuration is misunderstood entirely). Catches both forms Spring offers for the same footgun:

Shows errors and warnings inline, at the end of the line that has them, instead of only as a gutter icon or a squiggly underline you have to hover to read. One hint per line (most severe diagnostic wins) so it never turns into unreadable clutter.

Flags a CHANGELOG.md release entry (Keep a Changelog format) whose own body text reads as a breaking change: either the literal word "BREAKING", or a ### Removed section (Keep a Changelog's own standard header for removed features, a breaking change by definition) (but whose version, versus the release right before it, only bumped MINOR or PATCH) SemVer expects a MAJOR bump for a breaking c

Flags real Git merge-conflict markers (<<<<<<<, |||||||, =======, >>>>>>>) left behind in any file: a real, distinct problem from an active unresolved merge (which the IDE's own Commit window already flags in red): a merge that was already resolved and committed, but with the markers themselves accidentally left in the file. Covers both the standard 3-way conflict style and the diff3/

Warning on a named multi-stage Dockerfile build stage (FROM ... AS name) that's never referenced by a later COPY --from=name and isn't the file's own final stage: an orphaned intermediate stage that's real, wasted build time and a confusing read for the next person touching the file, usually left behind after a refactor that moved what it built into another stage.

Flags a Terraform aws_iam_role that can reach an admin-equivalent role through a real, whole-project AssumeRole trust chain.

Syntax highlighting and directive completion for nginx config files.

Gutter icon next to every recognized feature-flag-check call's key literal in Java/Kotlin code (isEnabled("checkout_v2"), variation("checkout_v2", false), and similar), showing how many times that exact key is referenced anywhere else in the open project: helps find orphaned flags (dead code left behind after a rollout completed) without connecting to any provider. 100

IntelliJ-family plugin (IntelliJ IDEA, Android Studio, and any IntelliJ-based IDE that bundles the Java and Kotlin plugins). Generates a real, compiling JUnit test skeleton for a Java or Kotlin class: one empty test method per public method, with your project's own test framework detected and imported correctly.

Gutter icon on any Java/Kotlin for loop whose body accesses a lazy-loaded JPA association directly on the raw loop variable: the classic N+1 query shape: fetch a collection, then trigger one extra query per element while iterating it.

Cross-checks every real environment-variable access in your open file (process.env.PORT, process.env["PORT"], import.meta.env.VITE_API_URL, os.environ["DEBUG"], os.environ.get("DEBUG"), os.getenv("TIMEOUT")) against your project's real .env/.env.example/etc. files, and warns on any variable that's used in code but never declared anywhere: with a real qu

Fast syntax highlighting for .graphql/.graphqls files, and multi-schema discovery that works out of the box: with or without a .graphqlconfig file.

Flags a log message whose placeholder count doesn't match its argument count: an error that today only surfaces at runtime: a leftover placeholder stays literal in the log output, or an extra argument is silently dropped, or (worst case) SLF4J misinterprets the last argument as an exception when it isn't one. Deliberately narrow (not a full SAST scanner like Qodana): o

Gutter warning icon on an AWS SDK for Java 2.x service client (S3Client, DynamoDbClient, SqsClient, SnsClient, LambdaClient, and similar) built via XxxClient.builder().build() inside a regular method body: AWS's own documentation states service clients are thread-safe and meant to be created once and reused; a client built inside a method means a brand new client (and its own connecti

Lightweight inline git blame (author and date at the end of the current line) designed from the ground up to never block the editor.

Local, rule-based code review hints for Java and Kotlin: no account, no rate limit, no cloud call.

Gutter warning icon on any Java/Kotlin Spring MVC endpoint whose mapping path contains "webhook" with no signature-verification signal anywhere in the handler body: the classic footgun where anyone who guesses (or finds leaked) the endpoint URL can send a forged event, because nothing checks the payload really came from the real sender.

A tool window with a pattern field and a sample-text area: type a regex, type or paste sample text, and every match is highlighted live as you type, with a real match count. Case insensitive, multiline, and dot-all flags are real checkboxes, not something you have to remember inline syntax for.

Flags a @KafkaListener method whose own transitive call graph reaches a .send(...) back to the SAME topic it consumes.

Warning on a real AWS SDK for Java call (application code, not infrastructure-as-code) that sets a PUBLIC ACL on an S3 bucket or object: SDK 1.x's AmazonS3.setBucketAcl(bucket, CannedAccessControlList.PublicRead)/PutObjectRequest.withCannedAcl(...)/ .setCannedAcl(...), and SDK 2.x's fluent .acl(ObjectCannedACL.PUBLIC_READ)/.acl("public-read").

Gutter warning icon on any Java/Kotlin Spring MVC @PostMapping/ @PutMapping (or @RequestMapping(method = ...)) endpoint method with no @RequestHeader parameter for an idempotency key: the classic footgun where a retried or double-submitted POST/PUT creates a duplicate side effect (a duplicate order, a duplicate charge) because nothing in the handler recognizes "I already saw this exact re

Flags a background-thread entry point in your plugin's own code that can reach a blocking, non-cancellable read-lock call: the pattern JetBrains' own Platform team has publicly named as a real, recurring cause of IDE freezes, with no static tooling to catch it today.

Validates a Kafka sample/message JSON file (named <topic>.sample.json or <topic>.message.json) against its sibling <topic>.schema.json JSON Schema file in the same directory: inline, in the editor, no broker connection, no schema registry.

Warning on a case <-time.After(...) inside a select block: Go's documented behavior: the Timer created by time.After is not recovered by the garbage collector until it fires, and a select inside any repeatedly-executed loop (the overwhelmingly common place a select appears) creates a new one on every iteration, leaking memory until each one's duration elapses. time.NewTimer(...) plus

Warning when a Dockerfile's FINAL build stage never sets a non-root USER: Docker runs a container as root by default when USER is absent.

Flags a job that checks out untrusted PR/workflow_run head content while secrets are reachable: the real "Pwn Request" pattern.

A dark, high-contrast editor color scheme plus a folder-icon provider that keeps source/test/resource root icons showing up, always.

Select exactly two env-style files in the Project view: .env vs .env.example, .env.development vs .env.production, anything with KEY=VALUE lines: run Compare Env Files, and get a real report of which keys are missing from each side.

Warning on an IAM policy statement (inside a Terraform aws_iam_policy/aws_iam_role_policy resource's jsonencode({...}) block) whose Action or Resource is "*" with no Condition scoping it down.

Visualizes the dependency graph between modules of a multi-module Gradle or Maven project, and highlights real circular dependencies when they exist: module/build-system level, not file/class-level "circular import" (already covered by several existing plugins). 100% static text/XML analysis of files already open in your project: no Gradle daemon, no Maven reactor buil

Select an identifier (or just place the caret on one: no selection needed) and instantly convert it between camelCase, PascalCase, snake_case, kebab-case, and CONSTANT_CASE.

Warning on a Postman collection (*.postman_collection.json) endpoint whose method+path no longer exists in the project's OpenAPI/Swagger spec. Collections and specs drift apart silently: a collection is hand-edited or an endpoint gets renamed/removed in the spec, and nothing tells the team the collection now exercises a path that doesn't exist, usually caught only when a request in the collecti

Warning icon on a HttpClients.createDefault(), HttpClients.createSystem(), or HttpClients.custom().build() construction (Apache HttpClient, both the 4.x org.apache.http and 5.x org.apache.hc.client5.http packages use HttpClients as the factory class) written inside a regular method body: Apache's own javadoc annotates CloseableHttpClient @Contract(threading = ThreadingBehavior.SAFE

Gutter warning icon on a CqlSession.builder()....build() construction chain (DataStax Java driver for Apache Cassandra) written inside a regular method body: DataStax's own best practices documentation states: "These root objects are expensive to create because they initialize and maintain connection pools to every node in a cluster... Create one session instance for each application, and then

Warning on any container entry in a Kubernetes workload manifest (Deployment, Pod, StatefulSet, DaemonSet, Job, CronJob) with no resources: block, or one missing requests/limits. Without requests, the scheduler can't make good placement decisions; without limits, a single container can consume unlimited CPU/memory and starve its neighbors on the same node: a real, common, and documented Kub

Warning icon on a package.json peerDependencies entry whose real installed version (from node_modules) doesn't satisfy the declared semver range: or isn't installed at all. npm's own peer dependency model is opt-in and silent: since npm 7 it auto-installs a compatible peer if it can, but a version mismatch, an unresolved conflict, or a peer installed via a workspace/hoisting quirk all produ

Select a JSON object: in a .json file, a string literal, anywhere: run Generate Class from JSON, and get a real Java POJO or Kotlin data class with field types inferred from the actual JSON values, including nested objects (their own nested/ sibling classes) and arrays (List<T>, typed from the first element).

Gutter warning icon on a new KafkaProducer<>(...) construction written inside a regular method body: Apache Kafka's own javadoc, unchanged across every released version, states "The producer is thread safe and sharing a single producer instance across threads will generally be faster than having multiple instances." Building one inside a method means the real connection/initialization cost is p

Warning on a Pattern.compile("...")/"...".matches("...") call in Java whose literal regex argument has a structural catastrophic-backtracking pattern: a nested unbounded quantifier ((a+)+), or an unbounded-quantified alternation with overlapping branches ((a|a)*). A single crafted input against either pattern can hang a server thread indefinitely.

IntelliJ-family plugin that flags a .thenCompose(...) chain whose result future can be cancelled, but whose inner future: constructed directly inside the lambda: never receives that cancellation, so the orphaned work keeps running and consuming resources after the caller believes the whole operation stopped.

Flags a workload that's Service-exposed but silently uncovered by every NetworkPolicy in the project.

Tool window that visualizes the real dependsOn graph between Gradle tasks in your project: root project plus every submodule declared in settings.gradle(.kts): grouped into dependency layers, with any real cycle called out in its own top section, in red.

Warning on a SET ... NX call (Jedis's SetParams.nx()/Lettuce's SetArgs.Builder.nx() manual distributed-lock pattern) with no EX/PX expiry chained onto the same builder.

Warning on params.permit! (or xxx_params.permit!): Rails' own official documentation states: "Extreme care should be taken when using permit!, as it will allow all current and future model attributes to be mass-assigned". This is the exact anti-pattern strong parameters exist to prevent: it disables the whitelist entirely, permitting whatever attributes an attacker sends in the request body,

Warning on a well-known dev/test gem (RSpec, RuboCop, Pry, FactoryBot, Capybara, SimpleCov, WebMock, VCR, and similar) declared at a Gemfile's top level instead of inside a group :development/group :test block, it ships in every environment, including production, bloating the bundle and (for something like Pry or letter_opener) a real footgun if it's ever accidentally reachable in productio

Warning on a Kafka consumer poll-loop (while (true) { ... poll(...) ... }) that dispatches asynchronous work (ExecutorService.submit(...), CompletableFuture.runAsync(...)/.supplyAsync(...)) without waiting for it to finish BEFORE the consumer commits offsets: either explicitly (commitSync()/commitAsync() called right there) or implicitly (no manual commit at all, relying on Kafka's o

Warning on system(...), exec(...), backticks ( ), or %x[...] whose command string contains #{...} interpolation: Ruby's own official documentation states: "Some Ruby core methods accept string data that includes text to be executed as a system command and should not be called with unknown or unsanitized commands", specifically naming Kernel#exec, Kernel#spawn, Kernel#system, a

Generates a real, compiling object-copy method between two Java or Kotlin classes. Select exactly two class files in the Project view, right-click → Generate Bean Copy Method, pick the copy direction, and get a new copier file with fields matched by name and type.

Warning on any container entry in a Kubernetes workload manifest (Deployment, Pod, StatefulSet, DaemonSet) with no readinessProbe: and/or no livenessProbe:. Without a readiness probe, Kubernetes can't take a sick pod out of the load balancer: real traffic keeps being routed to a broken instance. Without a liveness probe, a hung (not crashed) process is never automatically restarted. Both are

Gutter warning icon on a Redisson.create(...) call built inside a regular method body: Redisson's own Getting Started guide states: "RedissonClient is thread-safe, so create a single instance and reuse it as a shared singleton across your application." A client built inside a method means a brand new connection pool to the Redis/Valkey server gets created on every call.

Shows the name of every named group ((?<year>\d{4})) inline, right on the line of any Java or Kotlin regex literal that has one: no need to open a separate tool window just to remember what a pattern's groups are called. A companion tool window (reusing Regex Preview Companion's own matching engine) lets you test a pattern against real sample text and see every named gro

Warning on a suspected real secret (AWS access key, GitHub/Slack token, JWT, PEM private key, or a high-entropy value assigned to a secret-shaped key name) hardcoded directly in a config file: .properties, .env (and its variants), or a .yml/.yaml file. Config files are a real, common, separate place secrets get committed by accident: a real value pasted into application.yml "just for l

Warning on eval(, exec(, shell_exec(, system(, passthru(, or popen( whose argument is a double-quoted string with $variable interpolation, or a concatenation with a variable, rather than a static literal. PHP's own official manual states this for eval(): "pay special attention not to pass any user provided data into it without properly validating it beforehand", the same class of

Warning on mysqli_query(, ->query(, or ->exec( (the mysqli/PDO query methods) whose SQL string argument contains $variable interpolation or a concatenation with a variable, rather than a prepared-statement placeholder. This is the textbook SQL injection anti-pattern: prepared statements exist precisely so the SQL text and the data are sent to the database separately, string- building

Warning on a webhook/HMAC signature comparison that uses .equals()/ Arrays.equals() (short-circuits on the first differing byte) instead of MessageDigest.isEqual(...) (constant-time). An attacker can reconstruct a valid HMAC signature byte-by-byte by measuring response times, forging webhook events.

Warning icon on a @FeignClient(..., fallback = X.class) or fallbackFactory = X.class annotation whose project has no spring.cloud.openfeign.circuitbreaker.enabled=true (or the legacy feign.circuitbreaker.enabled=true) anywhere in a reachable config file: Spring Cloud OpenFeign's own reference docs are explicit: "If Spring Cloud CircuitBreaker is on the classpath and spring.cloud.openfeign

Warning on a Net::HTTP.get/.get_response/.post shorthand call found inside a loop/iterator block (.each do, .times do, while, for, brace-block { }), Ruby's own Net::HTTP documentation explains why this matters: "Creating a new HTTP connection for every request involves an extra TCP round-trip and causes TCP congestion avoidance negotiation to start over". The shorthand class met

Warning icon on a Spring MVC controller method parameter annotated @Valid/@Validated whose matching BindingResult/Errors parameter exists somewhere in the method signature, but isn't the parameter immediately following it: Spring's own ErrorsMethodArgumentResolver javadoc is explicit: "An Errors method argument is expected to appear immediately after the model attribute in the method si

Gutter warning icon on a Google Cloud client library (StorageOptions, FirestoreOptions, BigQueryOptions, PubSubOptions, and similar) built via XxxOptions.getDefaultInstance().getService() inside a regular method body: Google Cloud's own client libraries best-practices documentation says: "you should reuse the same client object for many requests when possible, instead of creating a new

A tool window with a JSONPath field and a sample-JSON text area: type an expression, type or paste sample JSON, and every matched node is highlighted live as you type, with a real match count.

Warning on a .save(...) call inside a method whose class also has a hand-rolled Map-backed cache field (populated by a computeIfAbsent/manual containsKey+put "get-or-compute" pattern), when that method never touches the cache field.

Flags a JDBC resource .close()/use reached with the resource already closed on some or every path.

Warning on include, include_once, require, or require_once whose path argument directly references a PHP superglobal ($_GET, $_POST, $_REQUEST, $_COOKIE). This is the textbook Local/Remote File Inclusion (LFI/RFI) anti-pattern: an attacker can point this at an arbitrary file via directory traversal, or a remote URL if allow_url_include is on.

Manages per-PR changelog fragments, the towncrier-style convention: instead of every PR editing the same CHANGELOG.md and fighting merge conflicts, each PR adds a small changelog.d/<issue>.<type>.md file, later collected into a real changelog at release time.

IntelliJ-family plugin that flags a hardcoded URL or host:port string literal in Java source that also appears, textually, as a value in one of the project's own config files (.properties/.yml/.yaml/.env), the value clearly belongs to config, and the code copy can now silently drift out of sync with it.

Warning on an RPC call made through a generated gRPC blocking stub (XxxGrpc.newBlockingStub(channel)....call(request)) whose stub-construction chain never passes through .withDeadline(...)/.withDeadlineAfter(...).

Warning icon on a .onNext(...) or .onError(...) call on a gRPC StreamObserver found, in textual order, AFTER an .onCompleted() call on the same receiver, within the same method body: gRPC's own StreamObserver javadoc states the contract explicitly: onNext "is never called after onError(Throwable) or onCompleted() are called", and "onCompleted may only be called once and if called it m

Warning on a Role/ClusterRole rule that combines a wildcard ("*") in verbs or resources with a sensitive resource: secrets, pods/exec, clusterrolebindings. This is the most common path to privilege escalation after a single pod is compromised in a cluster (OWASP Kubernetes Top 10, K03: Overly Permissive RBAC Configurations).

Warning on a header('Location: ...') call whose argument is built directly from a PHP superglobal ($_GET, $_POST, $_REQUEST, $_COOKIE). This is the textbook Open Redirect anti-pattern (CWE-601): an attacker crafts a link to the trusted site that redirects the victim to an attacker-controlled domain, commonly used for phishing since the initial URL still shows the trusted host. OWASP's ow

Warning on a new ObjectInputStream(...).readObject() call inside a Spring MVC/JAX-RS endpoint method whose constructor argument traces back (within the same method, one direct hop) to an untrusted parameter: CWE-502, Deserialization of Untrusted Data.

Gutter warning icon on any Java/Kotlin Spring MVC handler method that receives a correlation/trace-id header via @RequestHeader and makes an outbound HTTP call in its own body, but never references that header parameter again anywhere in the body: the common footgun where the incoming id is captured and then silently dropped instead of being forwarded to the downstream call, breaking distribute

Warning icon on a RabbitMQ Channel created with ....createChannel() and used for basicPublish(...) in the same method: RabbitMQ's own Java Client API Guide calls this a "classic anti-pattern to be avoided": "opening a channel for each published message... Channels are supposed to be reasonably long-lived and opening a new one is a network round-trip which makes this pattern extremely ineffi

Warning icon on a call to a Spring @Async method made from another method of the same declaring class: Spring's own documentation states this bypasses the AOP proxy entirely: "a call to the async-marked method from within the target object is not intercepted... self-invocation... effectively bypasses the proxy and its interceptor chain." The call still compiles and runs: just synchronously

Flags a real lock acquisition-order cycle inside a single Java class: the classic static-deadlock shape: before it ever happens at runtime.

Gutter warning icon on a streamObserver.onError(rawException) call where the argument isn't converted through gRPC's own Status type: gRPC's own StreamObserver.onError javadoc states the parameter "should be a StatusException or StatusRuntimeException, and callers should generally convert from a Status via Status.asException() or Status.asRuntimeException()". Passing a raw exception means i

Warning on call_user_func( or call_user_func_array( whose function-name argument directly references a PHP superglobal ($_GET, $_POST, $_REQUEST, $_COOKIE). This is the textbook Function Injection anti-pattern: OWASP's own guidance documents that "when an attacker passes a function name with user input to call_user_func, it can lead to remote code execution by passing the system functi

Place the caret on a variable, parameter, or field, run Insert Log Statement, and get a real println (Kotlin) / System.out.println (Java) inserted right after the enclosing statement: class, method, and line number already baked in as literal text. Remove All Log Statements finds and deletes every one this plugin has added to the current file, in one action.

Warning icon on a new RestHighLevelClient(...) (legacy client) or new ElasticsearchClient(...) (modern Java client) construction written inside a regular method body: Elastic's own documentation states "only one single instance should be created" and that it's "best practice to create your RestHighLevelClient instance as singleton" since "each instance creates its own connection pool". Buildi

Gutter warning icon on any Java/Kotlin test method annotated @Disabled (JUnit 5) or @Ignore (JUnit 4) with no reason given, or whose reason names a YYYY-MM-DD revisit date that has already passed. Skipped tests are easy to forget about entirely: without a reason, future readers have no context for why it's disabled; with a stale date, it's a real signal the test is overdue for a second look

Warning on an int * int/int + int expression assigned/passed directly to a long-typed destination (a local variable's initializer, an assignment, a method parameter, or a method return) with no widening cast on either operand.

Flags a call through an interface-typed reference, wrapped in a broad silent catch, where real implementations diverge on which RuntimeException they throw directly.

Flags a QueryBuilders.queryStringQuery(...)/.simpleQueryStringQuery(...) call whose argument is built from an HTTP endpoint parameter.

Warning icon on a Micrometer Timer.Sample sample = Timer.start(...) whose declaring method never calls .stop(...) on that sample anywhere: Micrometer's own reference docs show the sample usage as exactly two steps, start then stop, with no mention of a try/finally guard. A sample that's started but never stopped never records its timing, and per a real upstream Micrometer issue, can leak in l

Gutter warning icon on any Java/Kotlin Spring MVC endpoint method marked @Deprecated whose body never sets a deprecation-related HTTP response header: RFC 9745 Deprecation, RFC 8594 Sunset, or the common non-standard X-Deprecated. The @Deprecated annotation only warns people reading or compiling the source; it tells real API consumers (a mobile app, a third-party integration, another te

Warning on a HikariCP connection-pool setting (spring.datasource.hikari. or bare hikari.) set outside its own documented safe range in a .properties/.yml/.yaml config file: connectionTimeout below 250ms, maxLifetime below 30000ms, idleTimeout below 10000ms, or idleTimeout set greater than or equal to maxLifetime (HikariCP silently ignores idleTimeout in that case, a real,

Warning icon on a Ktor HttpClient(...) constructor call built inside a regular function body: Ktor's own documentation states plainly: "creating HttpClient is not a cheap operation, and it's better to reuse its instance in the case of multiple requests." Building one inside a regular function means a brand new client (and its own connection pool/engine) gets created on every call.

Warning on a JPA @Enumerated field with no explicit EnumType.STRING, on a real @Entity class: JPA's own default is ORDINAL.

Warning on a catch (Exception e) (the broad type, not a narrower specific exception) that silently swallows: no rethrow, no logging: a specific CHECKED exception that a call inside its try block can actually throw, directly or transitively through a bounded same-class call chain.

A Material Design-inspired dark editor color scheme (cool greys, blues, teals, and purples) with zero forced UI elements, zero paywalled customization, and zero performance cost.

Flags a real mutation of a value returned by a getter that hands back one of its own mutable fields directly.

Flags a call through an interface-typed reference, passing a resource, where real implementations diverge on guaranteeing to close it.

Flags a call through an interface-typed reference, passing tainted HTTP input, where real implementations diverge on whether they log it unsanitized.

Warning icon on a jjwt Jwts.parser()...parse(token) call chain: jjwt's own parse method accepts a JWT whose signature is empty or doesn't match, even when a signing key has been configured on the parser. This is a documented real vulnerability class: CodeQL ships a dedicated "Missing JWT signature check" query for exactly this pattern, and jjwt's own issue tracker confirms it. The fix is easy

Warning icon on a Counter.build()....register() (also Histogram/ Gauge/Summary, Prometheus's Java client's four metric types) construction written inside a regular method body: the client's own official documentation states "the best way to register a metric is via a static final class variable". Registration happens against the process-global default registry: calling .register() more

Warning icon on an RxJava xxx.subscribe(...) call (Observable/Flowable/Single/Maybe/Completable, RxJava 2.x/3.x) written as a bare expression statement: the returned Disposable is discarded immediately, with no way to ever call .dispose() on it later. RxJava's own guidance is explicit: always dispose of subscriptions when no longer needed, or this is a well-documented source of memory/resou

Learns the dominant checked-exception-handling convention your own file already established for a method, and flags the call sites that break with it.

Warning on an import of an internal package (project convention: a .internal. segment in the package path) from a DIFFERENT Gradle/Maven module than the one that declares it, hidden architecture coupling that, in large monorepos/microservices, precedes cascading-deployment incidents.

Warning icon on a new MongoClient(...) (legacy driver) or MongoClients.create(...) (modern com.mongodb.client driver) construction written inside a regular method body: MongoDB's own documentation states "you will only need one instance of class MongoClient even with multiple threads", and that not following the singleton pattern "may lead to too many open connections in MongoDB". A MongoCl

Warning on an HTTP call (HttpRequest.newBuilder(...)/Spring RestTemplate/OkHttp's Request.Builder) whose URL/host argument traces back (within the same method, one direct hop) to an untrusted Spring MVC/JAX-RS controller parameter, with no allowlist validation found in the same method: CWE-918, Server-Side Request Forgery.

Flags a mutable local variable shared with a background thread that the same method also touches afterward without synchronization.

Gutter warning icon on a Jackson mapper (ObjectMapper, XmlMapper, YAMLMapper, CBORMapper, CsvMapper) built via new inside a regular method body: Jackson's own javadoc states ObjectMapper is "meant to be used as singleton across the lifetime of the application... also very expensive to create". Building one inside a method means the real construction/configuration cost is paid on eve

Gutter warning icon on any Java/Kotlin tracer.spanBuilder(...)/ tracer.startSpan(...) call whose name argument is built from a dynamic value (string concatenation in Java, string template interpolation in Kotlin) instead of a static literal. Per OpenTelemetry's own documented naming guidance, each unique id/value becomes its own span name in the tracing backend instead of a low-cardinality a

Flags a SQL sink reading a @Entity field that's ALSO confirmed, elsewhere in the project, to be written from unsanitized HTTP input.

Flags an outbound HTTP call using an endpoint parameter that was only validated with .startsWith/.contains against a raw URL string.

Flags an XPath.evaluate(...)/.compile(...) call whose argument is built from an HTTP endpoint parameter.

Flags a synchronized block whose lock object is PROVEN to never be the same as another lock guarding the same field elsewhere in the class.

Gutter warning icon on any Java/Kotlin method annotated with a Resilience4j resilience annotation (@RateLimiter, @CircuitBreaker, @Retry, @Bulkhead, @TimeLimiter) whose fallbackMethod = "name" doesn't match any method in the enclosing class: a real, silent footgun: nothing fails at compile time, but Resilience4j throws at runtime the first time the fallback is actually triggered (rate

Flags a resource delegated to a helper method that doesn't guarantee closing it, where the caller never closes it either.

Warning on a logging/print call passed an instance of a class whose toString() exposes a PII field (email, SSN, phone, date of birth, credit card...): toString() on a user object often serializes the whole model, unlike log.info(user.getEmail()) which explicitly picks only what should be logged.

Flags a Spring ExpressionParser.parseExpression(...) call whose argument is built from an HTTP endpoint parameter, or is a hardcoded constant referencing a dangerous T(...) type.

Flags a DirContext.search(...) call whose filter argument is built from an HTTP endpoint parameter.

Warning icon on a Micronaut HttpClient.create(...) static factory call found anywhere in application code: the javadoc for this exact method is explicit: "this method should only be used outside the context of a Micronaut application" and "Within a Micronaut application use @Inject to inject a client instead", adding that "the creator is responsible for closing the client to avoid leaking conne

Gutter warning icon on an OkHttpClient built via new OkHttpClient() or new OkHttpClient.Builder().build() inside a regular method body: OkHttp's own documentation states "OkHttp performs best when you create a single OkHttpClient instance and reuse it for all of your HTTP calls, because each client holds its own connection pool and thread pools... creating a client for each request wastes r

Warning on a retry mechanism with a FIXED interval between attempts instead of exponential backoff + jitter: a manual for/while retry loop that Thread.sleep(constant)s in its catch, Spring @Retryable with no real exponential @Backoff, or Resilience4j's RetryConfig built with a fixed .waitDuration(...) and no .intervalFunction(...).

Flags an unsanitized logging call reachable from an HTTP endpoint parameter, anywhere in the project's real call graph.

Flags (TypeB) session.getAttribute("key") when every known write site for that exact key stores a genuinely incompatible type.

Warning icon on a call to a @Retryable (Spring Retry) or @CircuitBreaker/@Retry/@RateLimiter/@Bulkhead/@TimeLimiter (Resilience4j) method made from another method of the same declaring class. All of these are AOP-proxy-based, the same mechanism as Spring's own @Transactional/@Cacheable/@Async: self-invocation bypasses the proxy entirely, so the resilience behavior is silently

Validates the commit message you are currently writing, live, in the IntelliJ VCS Commit dialog: against the Conventional Commits convention, and shows the exact rule it breaks before you commit, instead of silently accepting or rejecting.

Gutter warning icon on any Java/Kotlin class field whose name looks like it holds PII (email, ssn, phoneNumber, dateOfBirth, creditCard, passportNumber, nationalId, taxId, and similar) with no annotation of any kind on it: no way for masking, redaction, or access-control tooling built around annotations to ever pick it up.

Shows the official name of any HTTP status code (404 -> Not Found, 503 -> Service Unavailable) inline, right after the numeric literal, in Java and Kotlin code: no need to look it up. Works in any code context, not tied to a specific HTTP framework's own annotations.