The Safeguard JetBrains plugin shows vulnerabilities in your dependencies inside the IDE, with CVE details and severity highlights. That helps an audit by showing developers see and fix issues early. It is not an evidence export tool, so reports and compliance mappings come from the platform instead.
We checked the plugin's documented features before writing this. Where the docs say it does not do something, we say so, instead of inventing a workflow.
What does the plugin do?
Per Safeguard's IDE support documentation, a separate JetBrains plugin covers IntelliJ IDEA, PyCharm, WebStorm and other JetBrains IDEs. It requires IDE version 2023.3 or later and JDK 17 or newer. To install, search for "Safeguard" under Settings, then Plugins, and restart the IDE. A downloaded ZIP also works.
It scans dependency manifests in real time across npm, Yarn and pnpm, pip, Poetry and Pipenv, Maven and Gradle, Go modules, Cargo and Bundler. In the IDE you get a Safeguard tool window with a vulnerability tree, CVE details and severity colored inline highlights. Commands live under the Tools menu, then Safeguard, and quick fixes appear through Alt+Enter.
Some features need you to log in. Without login, backend features are disabled or fall back to local behavior.
What the plugin does not document
The docs describe the compliance panel, SBOM panel, report export and AI assistant chat for VS Code and Cursor. They do not document equivalents for JetBrains. So if you want a one click evidence report from inside a JetBrains IDE, do not plan on it. Use the platform or the CLI for that.
What counts as audit evidence?
Auditors usually want proof of a working control: a defined process, a record that it ran, and follow up on exceptions. The IDE plugin contributes to the first and third parts in a modest way.
- Early detection. Developers see a vulnerable dependency while editing the manifest, which supports a claim that issues are caught before merge.
- Developer level detail. A CVE record and severity, visible where the fix happens.
- Consistent habit. A team that all uses the plugin can describe a common starting point in their process document.
What the plugin cannot do alone is prove anything to an auditor. A screen in a developer's IDE is not a record. The record comes from systems that keep history: your pull request checks, CI scan results, ticket system and the platform's scan history.
How to build the evidence trail
- Write the control. For example: "Dependencies are scanned in the IDE, on pull request and in CI. Critical findings are fixed or risk accepted within a set time."
- Run the scan where it leaves a record. The Safeguard CLI outputs SARIF and JUnit for CI, so results land in your build system.
- Keep the inventory. Generate an SBOM per release and store it with the artifact.
- Track exceptions. Every accepted finding needs an owner, a reason and a date.
- Map to the framework. Safeguard's compliance documentation says it maps automated tests from connected systems for frameworks such as SOC 2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0, and that each framework page states what a scan decides and what needs your own evidence. Read that page for your framework.
- Use the IDE for habit. Ask developers to open the tool window before they commit manifest changes.
Safeguard does not certify you against any framework, and a plugin does not replace the audit.
Quick example of the flow
A developer upgrades a package. The plugin flags a vulnerable transitive dependency in the tree. They use the quick fix or read the CVE detail, pick a safer version and commit. The pull request scan runs again, the SBOM is regenerated in CI, and the ticket for a risk accepted item links to the finding. An auditor sampling this change sees the pull request, the scan result and the SBOM, not the IDE screen.
See the IDE flow at /demos/gate-dev-ide.
What to do
- Install the plugin for the team and require login.
- Write the control in one paragraph and agree it with your compliance lead.
- Keep CI scan output and SBOMs as the system of record.
- Track accepted risks in your ticketing system.
- Sample one change per month end to end to test that the trail holds.
Quick check
Can the JetBrains plugin export an audit report?
The documentation we read does not describe that for JetBrains. Report export and compliance panels are documented for VS Code and Cursor, so use the platform or CLI for reports.
Does using the plugin make us compliant?
No. It helps developers catch issues early. Compliance depends on your controls, records and an audit, and Safeguard does not certify you.
Sources
- Safeguard documentation: IDE support, fetched 18 October 2026
- Safeguard documentation: Compliance, fetched 18 October 2026
- Safeguard CLI documentation, fetched 18 October 2026
Last reviewed: 18 October 2026.
