How to find leaked secrets from a JetBrains IDE with Safeguard

From a JetBrains IDE, you find leaked secrets by running Safeguard's CLI secrets scan in the IDE terminal and reviewing results on the platform. The JetBrains plugin itself, according to its documentation, focuses on dependency vulnerabilities. Knowing which tool does which saves you from expecting the plugin to catch a pasted API key.

What does the JetBrains plugin do?

It works in IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, Rider, GoLand, RubyMine, CLion, DataGrip and Android Studio, on version 2023.3 or later with JDK 17 or newer. Install it from Settings or Preferences, then Plugins, by searching for Safeguard, then restart. Sign in from Tools, Safeguard, Login. Public package scanning works without login.

It shows a Safeguard tool window with a vulnerability tree and colors flagged dependencies by severity: red for critical, orange for high, yellow for medium and blue for low. To fix one, press Alt+Enter and choose "Fix with Safeguard AI", then review the diff.

The plugin documentation does not describe a secrets feature. The only IDE reference to secrets in the docs is a VS Code and Cursor command, "Safeguard: Check Staged Commit for Secrets". So in JetBrains, use the CLI.

What does Safeguard secrets scanning look at?

The platform docs say it covers current source, git history, container image layers, packaged artifacts, CI build logs, vendor SBOMs and model weights. It uses three layers: patterns for more than 200 issuers such as AWS, GitHub, Slack and Stripe, generic patterns for private keys, JWTs and connection strings, and an entropy check for random looking strings.

For issuer specific matches, Safeguard makes a low privilege call to the issuer to see whether the credential still works. A verified, high privilege credential is critical. An unverified match for a known issuer is medium. A generic or entropy based hit is low. You can turn verification off per issuer, for example in an air gapped setup.

How do you run it from the IDE?

Install the CLI with npm (the package is @safeguard-sh/cli, Node 18 or newer) or Homebrew. Open the terminal inside your JetBrains IDE and, from the project root, run:

safeguard detect --detect secrets

That scans the working tree on your machine. The docs state there are no CLI commands yet for listing, revoking or rotating secret findings, so triage in the platform's Secrets dashboard.

Try it in the secrets scanning demo.

What do you do when it finds a real secret?

Order matters. The docs lay out four steps for verified findings: revoke the credential with the issuer, rotate it into a secret manager, optionally purge it from git history, and notify the owner and any dependent services.

Revoke first. Deleting a file or rewriting history does not help if the key is still valid. Treat any secret that ever reached a remote branch as exposed. History rewriting with git-filter-repo or BFG forces everyone to re-sync, so do it only after the key is dead.

How do you keep false alarms down?

Use allowlisting carefully. The docs describe an inline # safeguard:allow comment with a reason, path patterns in .safeguard/secrets-allow.yaml, and issuer level rules. Allowlist changes are tracked, so write real reasons. A test fixture with a fake key is a fine exception. A production config is not.

What to do

1. Install the JetBrains plugin and log in for dependency scanning.
2. Install the CLI and confirm it runs in the IDE terminal.
3. Run the secrets scan command above from the project root before you push.
4. Open the platform Secrets dashboard to review severity and verification.
5. Revoke any verified credential first, then rotate it.
6. Purge history only after revocation, and tell the team before force pushing.
7. Add allowlist entries only with a written reason.

Quick check

Sources

• Safeguard documentation: IDE support
• Safeguard documentation: Secrets scanning
• Safeguard documentation overview

Last reviewed: 18 October 2026.