Gap Hunter Labs
Security
What the plugins touch, what they never send anywhere, how to report a vulnerability, and where things stand on formal certification.
How these plugins are built
Every plugin in this catalog runs as a normal IntelliJ Platform extension: inspections, annotators, and intentions that execute inside your own IDE process, on your own machine, using the IDE's own PsiElement/AST APIs or plain text/regex checks over files already open in your project.
There is no backend. Plugin code has no server to call, so your source has nowhere to go. Detection logic (pattern matching, entropy checks, structural analysis) runs locally, and its output goes straight to the editor as a warning, a gutter icon or a quick-fix.
Network activity
- Plugin installation and update checks go through JetBrains Marketplace, the same channel every plugin on the platform uses.
- A small number of plugins call an external API by design because that's the plugin's stated job (for example, a spec-validation plugin that checks a schema against a public registry). Each of those calls goes to the third-party service the plugin's own listing names, and to no other server.
- This site uses GoatCounter to count visits: no cookies, no stored IP address, and sessions rather than raw pageviews. Methodology has the details. It has nothing to do with what the plugins do inside your IDE.
Open by default
Every plugin's source is a public repository under github.com/GapHunterLabs. You don't have to take any of the above on trust: the inspection and annotator code that decides what runs, and what happens with a match, is there to read for every plugin.
Reporting a vulnerability
Found a problem, such as a plugin doing more than its listing says, an insecure default, or a bundled dependency with a known CVE? Report it privately: with the Report a vulnerability button under the Security tab of the plugin's GitHub repository (preferred), or by email to gaphunterlabs@gmail.com with the subject SECURITY: <plugin name>.
Acknowledgement within 5 business days and an assessment within 10. Details stay private until a fix ships, for up to 90 days unless another date is agreed, and each fix is published as a GitHub Security Advisory. If the issue is being exploited in the wild, say so in the first message: those reports are handled first.
Security fixes for the paid plugins are provided at least until December 2031. Each repository's SECURITY.md has the full policy, and security.txt lists the security contacts.
Please don't open a public GitHub issue for a security report. Everything else (bugs, feature requests) is fine in the open as usual.
What isn't in place (yet)
No SOC 2, ISO 27001, or other third-party security certification is held. This is a small, focused catalog, not a company with a dedicated compliance team, and saying that plainly beats implying a level of formal assurance that isn't there.
The sections above describe how the plugins are built and run; they don't replace a certification. If your organization's procurement process requires SOC 2, that is a gap today.