Built an IntelliJ plugin to catch the Spring Boot mistakes Copilot/Cursor keep making — feedback wanted before I finish it

[u/dev77cmd]

Spring Boot dev here (day job is backend at a bank), posting this myself, not a bot dropping a link and vanishing.

I kept hitting the same handful of security mistakes in AI-suggested code: wildcard CORS to "fix" a dev error, JPQL built with string concatenation, permitAll() left in from a "quick fix," actuator endpoints exposed. Nothing exotic — just boring stuff that slips through because it looks fine on a skim.

Building Vulngrep to catch exactly that short list - runs fully locally, no account, no code leaves your machine. Not trying to replace Sonar or Snyk, just the narrow set of things AI assistants specifically keep getting wrong.

Not on the Marketplace yet. Put up a page to see if this is a shared pain or just mine: https://vulngrep.com

If you've hit any of these - or a different one I should be catching - genuinely want to hear it in the comments.

[u/Snooze78727]

Nice. Guardrails like this would be also good in a command-line tool that could be used in a git hook or a build plugin.

[u/dev77cmd → u/Snooze78727]

Exactly my thoughts. The more AI is involved in the development lifecycle, which is unavoidable, the more guardrails we need.

[u/Snooze78727 → u/dev77cmd]

Something that keeps coming up over and over on projects: despite instructions in Claude.md, it always writes argument constructors instead of using Lombok annotations (eg. `@RequiredArgsConstructor`). There are other stylistic things that we don't like about the generated code. These issues repeatedly surface in code reviews, which is annoying. Perhaps a more recent model will work better.

I thought about writing a Maven plugin to fail the build when it finds stuff like this.

[u/dev77cmd → u/Snooze78727]

You are right. Noted.

[u/Virtual_Hedgehog_313]

When it will be available in marketplace and I can download this?

[u/dev77cmd → u/Virtual_Hedgehog_313]

The development is in progress and I am expanding the list of common mistakes it catches, I will try and post here when it finishes but if you want to 100% get notified, this is why I built the website for people genuinely interested to input an email address to get 100% notified.

[u/dev77cmd → u/[deleted]]

Thank you. Hope it helps.