Catch Java security issues in IntelliJ IDEA by combining the editor's inspections, secure patterns such as parameterized queries, and a security extension that checks dependencies and code as you type. Then repeat the same checks in the pull request, since the IDE is optional and the pipeline is not.
What do IDE inspections do?
JetBrains documents inspections as scans that "detect and correct abnormal code in your project before you compile it". They flag probable bugs, dead code and structural problems. You can run them across the project or on a scope such as modified files, and each carries a severity that changes how it is highlighted. Profiles store which inspections are on.
The same page says security checks and license audits are provided by Qodana, a separate product that runs IntelliJ inspections in CI. So the built-in set is mostly correctness, and security depth comes from other tools.
What is the most common Java flaw to fix by hand?
Injection. The OWASP Java Security Cheat Sheet advises to "use query parameterization", with Connection.prepareStatement and ? placeholders bound through typed setters such as setString. For JPA, use named parameters bound with setParameter. For operating system commands, use a platform API instead of building a command string. For HTML output, apply context-specific encoding.
Constructed example: a search method builds its SQL by joining the user's text into the query string. Rewriting it to use a placeholder and setString removes the flaw, and the change is three lines. A reviewer can spot the pattern by looking for string concatenation near the word Statement.
What about cryptography in Java?
OWASP's advice: do not write your own cryptographic functions, and prefer a secret management solution over handling keys yourself. If you use JCA directly, a library such as Google Tink is safer, since JCA is easy to misuse. For AES-GCM, use a 256-bit key and a 12 byte nonce, and never reuse a nonce with the same key. Use TLS for data in transit instead of designing a protocol.
How do dependencies fit in?
Your own code is a minority of what ships. Libraries pulled through Maven or Gradle carry their own flaws, and the editor will not warn you about them unless a tool checks versions. This is the reason to add a security extension to the IDE.
Safeguard has an IDE extension for JetBrains IDEs, alongside VS Code and Open VSX or Cursor. It surfaces dependency and code findings inside the editor, so the feedback arrives while the change is still small. Reachability analysis helps decide which findings need action now.
How to check or apply this
- Open Settings, then Editor, then Inspections, and enable the Java inspections your team agrees on. Share the profile.
- Search your code for SQL built by string concatenation and convert each to a prepared statement.
- Remove any custom cryptography or hard coded keys. Move keys to a secret store.
- Install a security extension in the IDE for dependency and code checks.
- Add the same scan to pull requests so findings cannot skip review.
- Review the resolved Maven or Gradle dependency list monthly.
Quick check
Does IntelliJ IDEA find security vulnerabilities by default?
Its built-in inspections focus on correctness and code quality. JetBrains says security checks are provided by Qodana, a separate product, so add a security tool for dependencies and code.
What is the safest way to build a SQL query in Java?
Use parameterized queries with PreparedStatement and bound values, never string concatenation of user input.
Sources
Last reviewed: 18 October 2026.
