Qodana 2026.2 shipped with new security inspections, published benchmark results, post-quantum cryptography checks, and coverage reporting that no longer has to be pointed at the reports.
The security work sits in the .NET linter and runs by default. Qodana tracks untrusted data across files in C#, JavaScript, and TypeScript, which turns up SQL injection, command injection, cross-site scripting, and path traversal in places a single-location rule misses. Findings show up in the IDE and in CI alongside everything else the team already reads.
JetBrains splits the analysis in two. Pattern rules catch bad code at one spot, and a taint engine follows the data. Teams can add their own rules in the OpenGrep format.
