VULNGREP
IN DEVELOPMENT

Your AI assistant just shipped a wildcard CORS policy to prod.

Vulngrep is a JetBrains plugin that catches the small, specific list of security mistakes Copilot and Cursor keep making in Spring Boot — before you commit them. Runs entirely inside your IDE. No cloud, no account, nothing leaves your machine.

PaymentController.java
1@CrossOrigin(origins = "*")
2@RestController
3public class PaymentController {
⚠ Vulngrep — Wildcard CORS origin lets any site read this response. Suggested by Copilot to "fix the CORS error" — flagged before commit.
4
5 @PostMapping("/api/payments")
6 public ResponseEntity<Receipt> charge(...) { ... }
7}
What it catches

Five patterns, done properly — not a rehash of the whole OWASP Top 10.

Vulngrep doesn't try to replace SonarQube or Snyk. It's tuned specifically for what AI coding assistants actually get wrong in Spring Boot.

Wildcard / overly permissive CORS

The "just make the CORS error go away" suggestion that opens the endpoint to any origin.

String-concatenated JPQL

Query building via concatenation instead of parameter binding — classic injection, still generated constantly.

Unsafe Jackson polymorphic deserialization

Default typing left enabled where untrusted JSON can reach it.

permitAll() / disabled CSRF

The "quick fix" Spring Security config that was meant to be temporary.

Exposed actuator endpoints

Security config that can leave /actuator/env and friends open to unauthenticated access.

Findings are raised for review, not asserted as proven exploits. Severity is reasoned per pattern rather than defaulted, so a flag is worth stopping for.

Why local matters

Your code doesn't need to leave your machine to be checked.

Most security scanners want an account, a dashboard, and your source uploaded to their servers. That's a reasonable trade for a security team with a budget. It's a bad trade for a solo developer.

Typical cloud scanner
  • Account + org setup
  • Code uploaded to a third-party server
  • Priced per seat, per team
Vulngrep
  • Install and go — no account
  • Runs inside the IntelliJ process, nothing transmitted
  • One license, built for solo devs and small teams
Status

Currently in development. Get notified when it ships.

One email, when it's live on the JetBrains Marketplace. Reply and tell me the worst AI-generated security bug you've caught — it'll probably end up as detector #6.

No spam, no drip sequence. One email, when it's real.