Your AI assistant just shipped a wildcard CORS policy to prod.

Vulngrep is a JetBrains plugin that catches the small, specific list of security mistakes Copilot and Cursor keep making in Spring Boot — before you commit them. Runs entirely inside your IDE. No cloud, no account, nothing leaves your machine.

PaymentController.java

1@CrossOrigin(origins = "*")
2@RestController
3public class PaymentController {
⚠ Vulngrep — Wildcard CORS origin lets any site read this response. Suggested by Copilot to "fix the CORS error" — flagged before commit.
4
5    @PostMapping("/api/payments")
6    public ResponseEntity<Receipt> charge(...) { ... }
7}

What it catches

Five patterns, done properly — not a rehash of the whole OWASP Top 10.

Vulngrep doesn't try to replace SonarQube or Snyk. It's tuned specifically for what AI coding assistants actually get wrong in Spring Boot.

Wildcard / overly permissive CORS

The "just make the CORS error go away" suggestion that opens the endpoint to any origin.

String-concatenated JPQL

Query building via concatenation instead of parameter binding — classic injection, still generated constantly.

Unsafe Jackson polymorphic deserialization

Default typing left enabled on user-controlled input.

permitAll() / disabled CSRF

The "quick fix" Spring Security config that was meant to be temporary.

Exposed actuator endpoints

/actuator/env and friends left reachable without auth after a scaffolding suggestion.

Why local matters

Your code doesn't need to leave your machine to be checked.

Most security scanners want an account, a dashboard, and your source uploaded to their servers. That's a reasonable trade for a security team with a budget. It's a bad trade for a solo developer.

Typical cloud scanner

Account + org setup
Code uploaded to a third-party server
Priced per seat, per team

Vulngrep

Install and go — no account
Runs inside the IntelliJ process, nothing transmitted
One license, built for solo devs and small teams

Status

Currently in development. Get notified when it ships.

One email, when it's live on the JetBrains Marketplace. Reply and tell me the worst AI-generated security bug you've caught — it'll probably end up as detector #6.

Thanks — you're on the list.

No spam, no drip sequence. One email, when it's real.