Qodana Expands Security Analysis with OpenGrep Rules, and More

Modern software development teams face a difficult balancing act. Applications are growing more complex, release cycles are accelerating, and security expectations continue to rise. This is especially true in a time where much more code is generated daily, which needs to be checked. Teams need tools that can identify vulnerabilities early without creating additional friction for developers or overwhelming security teams with noise.

Now, we bring you expanded security analysis capabilities in Qodana through the integration of OpenGrep-powered inspections for .NET and JavaScript projects.

This enhancement combines Qodana’s existing code quality, vulnerability detection, dependency analysis, and taint analysis capabilities with hundreds of additional security-focused inspections, helping teams identify more risks before they reach production. Plus, it’s also possible to use own or third-party Opengrep rules as a result of this change.

Table of contents

More security coverage, one workflow

Combining OpenGrep with Qodana’s existing security intelligence

Built on trusted static analysis

Transparency and proof matter

Security that fits developer workflows

Looking ahead

Benchmarking Qodana’s security inspections against others

Frequently asked questionsWhat is OpenGrep?

How does Qodana use OpenGrep?

Which programming languages are supported?

Does OpenGrep replace Qodana’s existing inspections?

What types of security issues can OpenGrep detect?

Where are the results displayed?

Is OpenGrep suitable for CI/CD pipelines?

Why combine static analysis with OpenGrep?

Is OpenGrep included with Qodana?

More security coverage, one workflow

Security teams often find themselves managing multiple tools across the software development lifecycle.

One tool checks code quality. Another scans dependencies. A third performs security analysis. Each produces its own reports, workflows, and operational overhead.

With Opengrep-powered inspections integrated directly into Qodana, teams can consolidate more of their security and quality analysis into a single platform.

Developers continue working within the tools they already use while benefiting from expanded security coverage that includes:

Injection vulnerabilities, including SQL, command, and code injection

Cross-site scripting (XSS) and path traversal

Server-side request forgery (SSRF)

Selected deserialization and resource-allocation issues

Insecure coding patterns covered by Qodana’s ruleset

Unsafe data flows associated with supported vulnerabilities

Custom security checks for internal APIs, frameworks, and policies

The result is broader visibility without introducing another disconnected security solution.

Combining OpenGrep with Qodana’s existing security intelligence

This release is more than simply adding new rules. Qodana already provides static code analysis, vulnerability checking, dependency inspection, license auditing, quality gates, and advanced taint analysis capabilities.

The addition of Opengrep inspections extends this foundation, creating a more comprehensive approach to identifying security issues across the software development lifecycle.

By combining multiple analysis techniques, teams gain deeper visibility into potential risks while maintaining a consistent developer experience.

Built on trusted static analysis

As AI continues to reshape software development, security teams increasingly need confidence in the tools they rely on.

The new Opengrep-powered capabilities are based on proven static analysis techniques designed to identify security vulnerabilities directly within source code.

Rather than relying on probabilistic outputs, these inspections use deterministic analysis to help teams identify issues early and consistently.

For organizations seeking predictable, repeatable security scanning, static analysis remains one of the most effective ways to shift security left and reduce risk before deployment.

Transparency and proof matter

Security tooling should not be a black box.

As part of this initiative, we are investing in transparent benchmarking to help teams understand how security analysis solutions perform.

Our goal is simple: provide customers with clear, measurable insight into detection capabilities, true positive rates, and false positive rates so they can make informed decisions about their application security strategy.

Security teams deserve visibility into how their tools perform, not just marketing claims.

Security that fits developer workflows

The best security tools are the ones developers actually use and at JetBrains, we’ve always prioritised developer experience.

Because OpenGrep-powered inspections are integrated into Qodana, findings appear alongside existing code quality and security results within established development workflows.

Developers receive actionable feedback in their IDEs, pull requests, and CI/CD pipelines, allowing issues to be addressed earlier and more efficiently.

Organizations can continue enforcing standards through automated quality gates while gaining broader security coverage across their applications.

Looking ahead

Software security is becoming increasingly important as organizations manage growing codebases, expanding software supply chains, and AI-assisted development workflows.

By combining Qodana’s existing analysis capabilities with hundreds of additional Opengrep-powered inspections, we’re helping teams build a stronger foundation for secure software development.

This release represents another step toward our goal of giving engineering and security teams the visibility, confidence, and control they need to deliver high-quality, secure software at scale.

Stay tuned for more rules/inspections, OWASP/CWE coverage with expanded coverage, as we continue investing in security analysis across the Qodana platform.

Get Qodana 2026.2

Benchmarking Qodana’s security inspections against others

We’re making it easier to evaluate the performance of these inspections with SABER – a Static Analysis Benchmark Evolution Runner. Find out more about SABER benchmarking here.

Frequently asked questions

What is OpenGrep?

OpenGrep is an open-source static analysis engine designed to identify security vulnerabilities, insecure coding patterns, and framework-specific issues using a large library of community-maintained rules. It scans source code for known patterns associated with security risks and helps developers catch issues before software reaches production.

How does Qodana use OpenGrep?

Qodana integrates OpenGrep-powered security inspections directly into its existing code quality workflow. Rather than introducing another standalone security tool, OpenGrep findings appear alongside Qodana’s existing inspections, quality gates, and reports, allowing developers to review security and code quality issues in one place. It’s also combined with Qodana’s Taint Analysis which provides a strong alternative to other options.

Which programming languages are supported?

Qodana currently includes OpenGrep-powered security inspections for .NET and JavaScript projects – with planned future support for Kotlin and Java. These inspections complement Qodana’s existing language-specific static analysis and security capabilities.

Does OpenGrep replace Qodana’s existing inspections?

No. OpenGrep expands Qodana’s security coverage rather than replacing existing inspections. Qodana continues to provide JetBrains’ static analysis, quality gates, code coverage, vulnerability detection, dependency analysis, licence auditing, and other code quality features alongside OpenGrep-powered security checks.

What types of security issues can OpenGrep detect?

The additional inspection set includes checks for common security weaknesses such as:

Injection vulnerabilities, including SQL, command, and code injection

Cross-site scripting (XSS) and path traversal

Server-side request forgery (SSRF)

Insecure coding patterns covered by Qodana’s ruleset

Unsafe data flows associated with supported vulnerabilities

Custom security checks for internal APIs, frameworks, and policies

The exact findings depend on the language, framework, and enabled rules.

Where are the results displayed?

Security findings appear within the same Qodana workflows developers already use. Results can be viewed in supported IDEs, during CI/CD analysis, and in Qodana reports, allowing teams to investigate and remediate issues without switching tools.

Is OpenGrep suitable for CI/CD pipelines?

Yes. OpenGrep-powered inspections are designed to run as part of automated development workflows, helping teams identify potential security issues early in the software development lifecycle and enforce quality gates before code is merged or deployed.

Why combine static analysis with OpenGrep?

Modern software quality extends beyond style and correctness. As applications become more complex and AI-generated code becomes more common, teams increasingly need both traditional static analysis and security-focused pattern matching. Combining these capabilities provides broader coverage while keeping the developer experience consistent.

Is OpenGrep included with Qodana?

Yes. For supported languages, Qodana includes an OpenGrep binary built from JetBrains’ fork of OpenGrep and uses it to run additional security inspections. Available features depend on your Qodana edition and the language being analysed.

Get Qodana 2026.2