JetBrains released Qodana 2026.2 with a set of new security inspections that include post‑quantum cryptography checks for JVM code, expanded coverage reporting and public benchmark data.
Developers can now test quantum‑ready code.
Post‑quantum crypto inspections for JVM projects
The update adds five levels of cryptographic inspection that follow the National Institute of Standards and Technology’s post‑quantum recommendations. The lowest level flags legacy algorithms that are already vulnerable to quantum attacks, while the highest level flags any algorithm that falls short of the strongest security standards. Each level inherits the checks from the levels below it.
According to the release notes, the purpose of early detection is to prevent “harvest now, decrypt later” attacks, where an adversary stores encrypted traffic and waits for quantum hardware to become available. By warning developers about weak algorithms before code ships, Qodana aims to reduce the risk of future decryption.
Related: Companies drive AI, sysadmins keep it restrained
Security analysis across languages
The .NET linter now runs by default, tracking untrusted data across C#, JavaScript and TypeScript files. This cross‑file taint analysis can surface SQL injection, command injection, cross‑site scripting and path‑traversal issues that single‑location rules often miss. Findings appear directly in integrated development environments and continuous‑integration pipelines, alongside other alerts the team already monitors.
JetBrains splits the analysis into pattern rules that catch problems at a single point and a taint engine that follows data flows. Teams can also contribute custom rules in the OpenGrep format, extending the scanner’s capabilities.
Public benchmark results with SABER
The company introduced the Static Analysis Benchmark Evaluation Runner (SABER) to run Qodana against publicly available security benchmarks. Results compare Qodana’s findings with expected outcomes from CodeQL benchmarks for C# and JavaScript, a WebGoat.NET vulnerable application benchmarked against Sonar’s ground truth, and a post‑quantum demo project.
Aggregated runs are stored on a TeamCity server that allows guest login, making both the raw data and the ground‑truth comparison visible to anyone interested. This openness lets users see exactly what the scanner catches and what it misses.
Related: Microsoft’s AI Bug Disclosure Signals New Era For Security
One practical implication of this transparency is that teams can gauge how well Qodana aligns with industry‑standard detection rates before adopting it in production environments.
Enhanced coverage reporting and license checks
Coverage reporting no longer requires users to copy reports into a specific Qodana directory. The tool now automatically looks in default locations for JVM, Android, JavaScript, PHP, Python, Go and .NET projects. When analyzing pull requests, Qodana reports coverage for newly added code and highlights uncovered lines directly in the IDE.
The update also lets builds fail on prohibited dependency licenses. Two settings cover licenses the team disallows and licenses Qodana cannot identify, with incremental analysis breaking the run only for new violations. Laravel checks are enabled by default for PHP projects.
Future releases promise the same pattern rules and cross‑file taint analysis for Kotlin and Java code, matching the capabilities already present in the .NET linter.
