JetBrains announced the expansion of security analysis capabilities in the Qodana platform by integrating checks powered by the OpenGrep engine for .NET and JavaScript projects. This step adds hundreds of security checks to Qodana’s existing capabilities for code quality, vulnerability detection, dependency analysis, and data-flow analysis known as Taint Analysis, while allowing teams to use their own OpenGrep rules or rules provided by third parties.
The announcement came on August 17, 2026, alongside reference to the release of Qodana 2026.2. JetBrains says the integration aims to broaden risk detection without forcing development and security teams to manage a separate tool, reports, and additional workflows.
What Do OpenGrep Checks Add?
The integration adds checks targeting common patterns of security issues, with actual results varying according to the programming language, framework, and enabled rules. The coverage mentioned in the announcement includes:
- Injection vulnerabilities, including SQL, command, and code injection.
- Cross-Site Scripting (XSS) attacks and path traversal.
- Server-Side Request Forgery (SSRF).
- Some deserialization and resource-allocation issues.
- Unsafe coding patterns covered by the Qodana rule set.
- Unsafe data flows associated with supported vulnerabilities.
- Custom checks for internal APIs, frameworks, and organizational policies.
These checks do not replace Qodana’s existing capabilities; instead, they operate alongside the platform’s own static analysis, dependency and license checks, vulnerability detection, quality gates, and Taint Analysis. Qodana uses a binary version of OpenGrep built from JetBrains’ fork of the project.
What Changes in Practice for Development Teams?
The results appear within existing Qodana workflows rather than being isolated in a separate security tool. According to JetBrains, developers can review the results in supported integrated development environments, during CI/CD analysis, and in Qodana reports. Automated quality gates can also be used to enforce standards before code is merged or deployed.
This means security teams can broaden the scope of scanning while developers review quality and security issues in a single context. This point is particularly important as the volume of code produced each day increases, including code generated with the assistance of artificial intelligence, according to the context JetBrains provided in the announcement.
Languages and Availability
Integrated OpenGrep checks are currently available for .NET and JavaScript projects. JetBrains plans to add future support for Kotlin and Java, without the announcement specifying a date. Available features also depend on the Qodana version and the language being analyzed.
JetBrains emphasizes that the checks rely on rule-based static analysis rather than probabilistic outputs. This approach enables repeatable checks, while the accuracy of the results remains tied to the rules, language, and framework used.
Transparency and Performance Measurement
JetBrains is working to provide clearer measurement of the performance of Qodana’s security checks through the SABER tool, an acronym for Static Analysis Benchmark Evolution Runner. The initiative aims to help teams evaluate detection capabilities, true-positive rates, and false positives rather than relying solely on marketing claims.
The announcement did not provide specific figures for the results of these comparisons. It also indicated that work continues on adding more rules and expanding OWASP and CWE coverage. Therefore, the final coverage scope remains affected by the Qodana version, language, enabled rules, and nature of the code being scanned.