Qodana 2026.2 adds post-quantum crypto checks for JVM code
Qodana 2026.2 shipped with new security inspections, published benchmark results, post-quantum cryptography checks, and coverage reporting that no longer has to be pointed at the reports.
The security work sits in the .NET linter and runs by default. Qodana tracks untrusted data across files in C#, JavaScript, and TypeScript, which turns up SQL injection, command injection, cross-site scripting, and path traversal in places a single-location rule misses. Findings show up in the IDE and in CI alongside everything else the team already reads.
JetBrains splits the analysis in two. Pattern rules catch bad code at one spot, and a taint engine follows the data. Teams can add their own rules in the OpenGrep format.
Anyone can read the benchmark runs
SABER, the Static Analysis Benchmark Evaluation Runner, runs Qodana against public security benchmarks and compares its findings with the known expected results. The suite covers CodeQL benchmarks for C# and JavaScript, the WebGoat.NET vulnerable app scored against Sonar’s published ground truth, and a post-quantum demo project.
Runs and aggregated results sit on a TeamCity server with guest login open. A ground-truth comparison records what a scanner catches and what it walks past. Both columns are public.
Crypto checks come in five levels
Qodana for JVM flags cryptography that a quantum computer would break. The inspection groups follow NIST’s post-quantum recommendations, running from the lowest level, which flags pre-quantum and legacy algorithms, up to the highest, which flags everything short of maximum security. Each level carries the ones beneath it.
The reason to start early is storage. An attacker who copies encrypted traffic can sit on it until the hardware to open it exists, an approach known as harvest now, decrypt later.
License gates, Laravel, coverage
A build can fail on dependency licenses. Two settings cover licenses the team prohibits and licenses Qodana cannot identify, and on incremental analysis only new violations break the run. Laravel checks are on by default in Qodana for PHP.
Coverage reporting no longer requires copying reports into a Qodana directory, since it looks in the default locations for JVM, Android, JavaScript, PHP, Python, Go, and .NET projects. Pull request analysis reports coverage for newly added code, and the IDE highlights the changed lines no test touches.
Kotlin and Java code gets the same pattern rules and cross-file taint analysis in a future release. The .NET linter has both now.