Work with Joel
Engineering services
Fixed-scope, fixed-price engineering for teams that build or depend on developer tools, enterprise platforms and open-source software: performance audits, security reviews, platform updates and custom tooling. Written deliverables, async by default.
Plugin performance audit
For JetBrains plugins with reports of UI freezes, typing lag or high CPU: reproduction on each IDE version you support, measurements on the UI thread, a review of the code for freeze patterns, and patches with before-and-after measurements.
- Base
- One plugin, up to 3 IDE versions.
- USD 10,500 · 10 business days
- Extended
- More than 3 IDE versions, or a plugin with several background subsystems, language servers or external processes.
- USD 15,000 · 15 business days
The same method found and reported freeze bugs in the IntelliJ Platform itself — see the JetBrains Platform tickets.
Plugin updates for new IDE versions
Your plugin built and verified against the IntelliJ versions you need to support: removed or deprecated APIs, Kotlin K2 mode, IntelliJ Platform Gradle Plugin 2.x and Plugin Verifier failures. It is the process that keeps our own catalog compatible with each new release. You receive the changes as a pull request, the Plugin Verifier report for each target version and a written list of the API changes that were resolved.
- Minor
- Deprecated APIs, IntelliJ Platform Gradle Plugin 2.x and Plugin Verifier warnings.
- USD 4,500 · 5 business days
- Major
- Removed APIs, Kotlin K2 mode, or a plugin with several modules.
- USD 9,000 · 10 business days
Dependency and CI/CD security review
A read-only review of the repositories you choose: known vulnerabilities in production dependencies, dependency-confusion risks in manifests and lockfiles, and CI/CD workflow permissions, checked with OSV-Scanner and OpenSSF Scorecard. Optional EU Cyber Resilience Act readiness check: security policy, security.txt, SBOM and the vulnerability-reporting workflow (technical, not legal advice). The written report gives each finding with its source and the version that fixes it, when one exists. Anything exploitable is reported first through your security channel.
- One repository
- One repository and its CI/CD workflows.
- USD 4,800 · 5 business days
- Up to 5 repositories
- Up to 5 repositories of the same system.
- USD 12,000 · 10 business days
- CRA readiness
- Optional, added to either level: security policy, security.txt, SBOM and the vulnerability-reporting workflow.
- + USD 1,500 · + 2 business days
Custom plugins and inspections
Inspections tailored to your codebase, such as internal APIs, secret formats and security patterns, delivered as a plugin your team installs. The same checks can run in GitHub Actions or GitLab CI, and the plugin can be served from a private plugin repository.
- Up to 3 inspections
- Packaged as a plugin your team installs, with tests for each inspection.
- USD 7,500 · 10 business days
- Full plugin with CI
- The inspections also run in GitHub Actions or GitLab CI, and the plugin is served from a private plugin repository. The delivery date is set in the scope.
- From USD 15,000
How engagements work
- Fixed scope and fixed price, agreed in writing before any work starts.
- Prices are published in USD, per engagement. The written scope confirms which level applies, within 2 business days.
- 50% when the work starts and 50% on delivery.
- Written deliverables; async by default (email and a pull request), with a call if you prefer one.
- Paid by international bank transfer in USD, against an invoice.
- Your code and data stay confidential; signing your NDA is fine.
Start
Email gaphunterlabs@gmail.com or use the contact page. Tell me the plugin or repository and what you need, and you will get the scope, delivery date and price in writing before any work starts.