Catch dependency risk in JetBrains before you open a pull request

The Safeguard JetBrains plugin scans your dependency manifests, shows vulnerabilities in a tool window and offers fixes you review before applying. It does not gate pull requests. Use it to clean up before you push, and rely on a CI gate or PR Guard in the web app for the review step.

Which IDEs and projects does it cover?

Per the Safeguard docs, the JetBrains plugin covers IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, Rider, GoLand, RubyMine, CLion, DataGrip and Android Studio. It requires IDE 2023.3 or later and JDK 17 or later. Package managers supported across the IDE extensions include npm, Yarn and pnpm, pip, Poetry and Pipenv, Maven and Gradle, Go modules, Cargo and Bundler.

The VS Code and Cursor extension and the JetBrains plugin are separate codebases. Some features documented for VS Code, such as the inline Package Firewall checks and the AI chat panel, are not documented for JetBrains, so this post covers only what the docs describe for the plugin.

Does it gate a pull request?

No. The IDE support page describes scanning, viewing and fixing. The severity setting filters what you see and does not block anything. Pull request review is a separate feature, PR Guard, in the web app. It analyzes a GitHub pull request's diff and can post comments to GitHub. The JetBrains docs do not connect the two.

So the honest framing is: the plugin helps you arrive at the pull request with fewer known problems.

How do you set it up?

1. Install the plugin from Settings, then Plugins, and restart the IDE. A plugin ZIP can also be installed from disk.
2. Sign in. The plugin uses the OAuth 2.0 device flow: it opens app.safeguard.sh/activate and you approve a verification code. Tokens are kept in the IDE's secure credential storage. The docs note that scanning public packages works without login, while backend features need it.

How do you scan and read results?

Right-click a manifest and choose Safeguard, then Scan File for Vulnerabilities. Or use Tools, then Safeguard, then Scan Project.

Results appear in a Safeguard tool window as a tree, package first and CVEs below it. Double-clicking a CVE shows its CVSS and CWE details. Inline highlights are colored by severity: red for critical, orange for high, yellow for medium and blue for low.

How do you fix what it finds?

Put the cursor on a flagged dependency and press Alt plus Enter (Option plus Return on a Mac). Choose Fix with Safeguard AI, then pick a strategy:

• Safe: minor version updates only.
• Balanced: minor and patch updates. This is the default.
• Aggressive: the latest available version.

You review the diff before applying it. A Fix All Vulnerabilities action is available from the tool window. Review each upgrade, since a major version jump can change behavior.

How does this fit a pull request workflow?

1. Make your change and scan the project in the IDE.
2. Fix the critical and high items with a Balanced strategy, and read each diff.
3. Run your tests.
4. Push and open the pull request.
5. Let the CI checks and PR Guard review the diff. The demo below is an interactive walkthrough of IDE side checks.

Open the IDE gate demo

What does the documentation not say?

For JetBrains the docs do not describe inline package firewall flags, a chat assistant, SBOM export or a full command list. They also do not explain how ignored vulnerabilities are recorded or reviewed. If you need those, check the plugin on your own install before depending on them.

What to do

1. Install the plugin on one machine and scan a real project.
2. Pick a default strategy for the team. Balanced is the documented default.
3. Make scan then fix then test a habit before every pull request.
4. If you need a rule that blocks merges, add the CLI to CI.
5. Report gaps to Safeguard so they reach the docs.

Quick check

Sources

• Safeguard docs, IDE Support
• Safeguard docs, PR Guard

Last reviewed: 18 October 2026.