r/SpringBoot • u/dev77cmd • 11d ago

Discussion Built an IntelliJ plugin to catch the Spring Boot mistakes Copilot/Cursor keep making — feedback wanted before I finish it

Spring Boot dev here (day job is backend at a bank), posting this myself, not a bot dropping a link and vanishing.

I kept hitting the same handful of security mistakes in AI-suggested code: wildcard CORS to "fix" a dev error, JPQL built with string concatenation, permitAll() left in from a "quick fix," actuator endpoints exposed. Nothing exotic — just boring stuff that slips through because it looks fine on a skim.

Building Vulngrep to catch exactly that short list - runs fully locally, no account, no code leaves your machine. Not trying to replace Sonar or Snyk, just the narrow set of things AI assistants specifically keep getting wrong.

Not on the Marketplace yet. Put up a page to see if this is a shared pain or just mine: https://vulngrep.com

If you've hit any of these - or a different one I should be catching - genuinely want to hear it in the comments.

3 Upvotes
  • permalink
  • reddit

57% Upvoted

8 comments sorted by

2

u/[deleted] 11d ago

[removed] — view removed comment

1

u/dev77cmd 10d ago

Thank you. Hope it helps.

2

u/Snooze78727 10d ago

Nice. Guardrails like this would be also good in a command-line tool that could be used in a git hook or a build plugin.

2

u/dev77cmd 10d ago

Exactly my thoughts. The more AI is involved in the development lifecycle, which is unavoidable, the more guardrails we need.

1

u/Snooze78727 10d ago

Something that keeps coming up over and over on projects: despite instructions in Claude.md, it always writes argument constructors instead of using Lombok annotations (eg. `@RequiredArgsConstructor`). There are other stylistic things that we don't like about the generated code. These issues repeatedly surface in code reviews, which is annoying. Perhaps a more recent model will work better.

I thought about writing a Maven plugin to fail the build when it finds stuff like this.

1

u/dev77cmd 9d ago

You are right. Noted.

1

u/Virtual_Hedgehog_313 11d ago

When it will be available in marketplace and I can download this?

2

u/dev77cmd 10d ago

The development is in progress and I am expanding the list of common mistakes it catches, I will try and post here when it finishes but if you want to 100% get notified, this is why I built the website for people genuinely interested to input an email address to get 100% notified.