The Safeguard JetBrains plugin shows a tree of packages and their CVEs, highlights vulnerable lines by severity, shows CVSS and CWE details on a double click, and offers an AI fix with a diff to review. The docs do not say it shows reachability, so use the platform for that question.
Why not ask the plugin whether a finding is reachable?
It is a fair question, and the plugin docs leave it open. The IDE support page does not say whether either the JetBrains plugin or the VS Code extension surfaces reachability analysis. We will not guess.
Reachability is documented as a platform capability: Safeguard's docs describe static, dynamic and configuration methods and four classes, reachable, conditionally reachable, unreachable and unknown, shown in the Vulnerabilities view and queryable through the Griffin assistant. So the practical split is simple. Use the IDE to see and fix. Use the platform to ask whether the vulnerable code is actually called.
What does the plugin cover?
The JetBrains plugin is a separate codebase from the VS Code and Cursor extension, with its own version number and release cycle. Per the docs, it supports IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, Rider, GoLand, RubyMine, CLion, DataGrip and Android Studio. It needs IDE version 2023.3 or later and JDK 17 or later.
Manifest scanning works for these ecosystems: npm, Yarn and pnpm, pip, Poetry and Pipenv, Maven and Gradle, Go modules, Cargo, and Bundler. Scan on save and on project open are on by default, and you can run a scan from the right click menu.
How do you install and sign in?
Open Settings, then Plugins, install Safeguard, and restart the IDE. A downloaded ZIP also works. Sign in from Tools, then Safeguard, then Login. The plugin uses an OAuth device flow: you approve a code in your browser at app.safeguard.sh/activate. Codes expire, and the docs say the extension version allows ten minutes, so run Login again if yours lapses. You can open the activation link on another machine.
Without signing in, public package scanning still works, but backend verified Package Firewall verdicts and backend notifications are unavailable.
What do you see in the tool window?
A Safeguard tool window lists packages with their CVEs in a tree. Double clicking a CVE shows CVSS and CWE details. In the editor, vulnerable lines are highlighted by severity.
To fix, press Alt+Enter on a flagged line and choose "Fix with Safeguard AI". The plugin shows a diff before applying anything. Fix All is in the tool window. There are three strategies: Safe applies minor updates only, Balanced is the default and applies minor and patch updates, and Aggressive moves to the latest version. Pick Safe on a release branch.
What is not documented for JetBrains?
The docs list several features for VS Code and Cursor and say nothing about them for JetBrains: inline Package Firewall checks, the interactive AI chat panel, and SBOM export. The JetBrains docs publish no full command list either. If you need those in a JetBrains IDE, ask Safeguard first.
What to do
- Install the plugin and sign in with the device flow.
- Open a project with a supported manifest and let the first scan finish.
- Sort the tree by severity and open the top CVE for CVSS and CWE detail.
- Use Fix with Safeguard AI on one finding with the Safe strategy, and read the diff.
- For "is it reachable", open the same finding in the web app and read its reachability class.
- Run your tests before committing the upgrade.
Quick check
Does the JetBrains plugin show reachability?
The docs do not say it does. Reachability is documented in the platform's vulnerability views.
Which JetBrains IDEs are supported?
IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, Rider, GoLand, RubyMine, CLion, DataGrip and Android Studio, on version 2023.3 or later with JDK 17 or later.
Sources
- Safeguard IDE support docs, fetched 18 October 2026
- Safeguard reachability analysis docs, fetched 18 October 2026
Last reviewed: 18 October 2026.
