Vulngrep is a plugin for IntelliJ IDEA. It checks your Java Spring Boot code as you write it, explains each security mistake in plain language, and shows how to fix it. Nothing ever leaves your computer.
Coming soon to the JetBrains Marketplace, with a free plan.
Whatever a visitor types as their email goes straight into this query. An attacker can type query code instead and read other customers' data.
JPQL built by string concatenation. Pass the value as a named parameter instead.
Vulngrep's guidance: send the email to the database as a separate value, so nothing a visitor types can change the query.
A spell-checker underlines a typo the moment you make it. Vulngrep does the same for security mistakes in Spring Boot code, whether a developer typed the code or accepted it from an AI assistant.
Problems get fixed in seconds, while the code is still on the developer's screen, instead of turning up months later in an audit or an incident report.
Add Vulngrep to IntelliJ IDEA from the JetBrains Marketplace. There's nothing to configure and no Vulngrep account to create.
By hand or with Copilot, Claude, Cursor or any other assistant. Vulngrep checks every file as it changes.
Risky code gets underlined, with a one-sentence explanation anyone can understand and clear guidance on how to fix it.
Vulngrep only covers Spring and Spring Boot. That focus lets it recognize the specific mistakes AI assistants make there most often, and explain them in words your whole team understands.
permitAll() that open more than intended
Every check is included in the free plan. New checks ship as AI coding habits change.
Vulngrep runs entirely inside IntelliJ IDEA. For companies, that means no new place where source code is stored, and far less for a security team to review before approving it.
Every check is free. Pay for the workflow that keeps a whole project reviewed: project scans, baselines and commit review. Sold through the JetBrains Marketplace, so your company buys from a vendor it already knows.
No card, no account
About €3.25 a month
or €39/year, 2 months free
14-day free trial
About €8.25 per developer a month
or €99/year per developer, 2 months free
14-day free trial
Volume pricing for larger teams
Pay by invoice or bank transfer
A plugin for IntelliJ IDEA that spots security mistakes in Spring Boot code while it's being written, explains them in plain language, and shows how to fix them.
No. Every check runs locally inside IntelliJ IDEA. Vulngrep has no server that receives your code, and it works without an internet connection.
Java code using Spring and Spring Boot, tested with Spring Boot 3 and 4, in IntelliJ IDEA 2025.2 and newer. Kotlin and reactive WebFlux applications aren't supported yet.
The first version is being built now. Join the waitlist and you'll get one email when it's available on the JetBrains Marketplace.
Personal is for developers paying with their own money. You can use it on any project, including at work.
Organization is for companies paying for their developers. The company owns the licenses and can move them between people.
After 12 paid months in a row, you keep a working copy of the version you had, forever. You just stop receiving updates.
If you stop earlier, the paid workflow (Security view, baselines, commit review) switches off. Every check keeps working in your editor.
No. Vulngrep works alongside them. It adds Spring-specific checks at the earliest possible moment, on the developer's screen, so fewer problems reach those later stages.
No tool can. Vulngrep catches a specific, growing set of common Spring mistakes. Treat it as a strong first line of defense, not a replacement for code review, testing and security audits.
Yes. Everything is handled in writing: security questionnaires, invoices, volume pricing and offline license activation. Email hello@vulngrep.com.
Get one email when the plugin is live. No newsletter, no spam.