How do you triage a critical vulnerability from your JetBrains IDE?

To triage a critical vulnerability, answer five questions in order: is the package really in your build, is the vulnerable code reachable, is it exploited in the wild, is a fix available, and what breaks if you apply it. A security plugin inside your JetBrains IDE puts the first answers next to the code you are editing.

What does the plugin give you?

Safeguard publishes an extension on the JetBrains Marketplace for IntelliJ, PyCharm, WebStorm, GoLand, Rider and other JetBrains IDEs. Its purpose is security insight as you code. We describe only that here. Exact menus and button names change between versions, so follow the plugin's own listing and docs for the clicks, and treat this post as the thinking that sits behind them.

Question 1: is it really in your build?

A scanner report can name a package that your project declares but never ships, or one that only a test tool pulls in. Open the manifest the finding points to. Check whether the dependency is direct or arrives through another package, and whether it is in the runtime set or only in development. A development only dependency in a library you never publish is rarely urgent.

Question 2: is the vulnerable code reachable?

A critical score describes the flaw in the abstract. Your risk depends on whether your code calls the affected function. Reachability analysis traces calls from your code into the library. If no path exists, the finding can usually wait for the normal upgrade cycle. If a path exists, keep going. Safeguard offers reachability analysis in the platform, and the IDE is a good place to read the call path against your own source.

Question 3: is anyone exploiting it?

Check whether the CVE appears in CISA's Known Exploited Vulnerabilities catalogue and what its exploit prediction score is. A critical flaw that is actively exploited and reachable goes to the top. One that is neither can be scheduled.

Question 4: is a fix available?

Find the lowest version that removes the flaw. Prefer a patch release in the same major line. If none exists, look for a configuration that disables the vulnerable feature, a vendor advisory with a workaround, or a replacement package.

Question 5: what breaks?

Run the tests in the IDE after the bump. Read the changelog between your version and the fixed one for removed APIs. If the upgrade crosses a major version, plan it as a small project, not a quick edit.

See the guardrail idea in action

Open the full IDE demo

What to do

1. Install the Safeguard plugin from the JetBrains Marketplace and sign in with your account.
2. Open the project and find the critical finding. Note whether the dependency is direct or transitive.
3. Check reachability before deciding urgency.
4. Look the CVE up in the KEV catalogue and note its exploit prediction score.
5. Pick the smallest safe version bump and run your tests in the IDE.
6. Record the decision in the ticket, including why you did not fix anything that was unreachable.
7. If you cannot fix today, set a date and an owner, not a vague promise.

Quick check

Sources

• Safeguard downloads, including IDE extensions
• CISA Known Exploited Vulnerabilities Catalog
• OWASP Top 10 2025, A03 Software Supply Chain Failures

Last reviewed: 18 October 2026.