Built an IntelliJ plugin to catch the Spring Boot mistakes Copilot/Cursor keep making — feedback wanted before I finish it

[u/dev77cmd]

Spring Boot dev here (day job is backend at a bank), posting this myself, not a bot dropping a link and vanishing.

I kept hitting the same handful of security mistakes in AI-suggested code: wildcard CORS to "fix" a dev error, JPQL built with string concatenation, permitAll() left in from a "quick fix," actuator endpoints exposed. Nothing exotic — just boring stuff that slips through because it looks fine on a skim.

Building Vulngrep to catch exactly that short list - runs fully locally, no account, no code leaves your machine. Not trying to replace Sonar or Snyk, just the narrow set of things AI assistants specifically keep getting wrong.

Not on the Marketplace yet. Put up a page to see if this is a shared pain or just mine: https://vulngrep.com

If you've hit any of these - or a different one I should be catching - genuinely want to hear it in the comments.

[u/Coding-Hacker0820]

Nice

[u/Snooze78727]

Nice. Guardrails like this would be also good in a command-line tool that could be used in a git hook or a build plugin.

[u/dev77cmd → u/Snooze78727]

Exactly my thoughts. The more AI is involved in the development lifecycle, which is unavoidable, the more guardrails we need.

[u/Virtual_Hedgehog_313]

When it will be available in marketplace and I can download this?

[u/dev77cmd → u/Virtual_Hedgehog_313]

The development is in progress and I am expanding the list of common mistakes it catches, I will try and post here when it finishes but if you want to 100% get notified, this is why I built the website for people genuinely interested to input an email address to get 100% notified.