Qodana 2026.2 Introduces Post‑Quantum Crypto Checks for JVM Code
What Happened — JetBrains shipped Qodana 2026.2, adding static‑analysis inspections that automatically flag cryptographic algorithms vulnerable to quantum‑computing attacks in JVM projects. The release also expands taint‑tracking across C#, JavaScript, TypeScript and .NET, and makes benchmark results publicly viewable on a TeamCity server.
Why It Matters for Compliance & Audit Readiness
- Detecting legacy or weak cryptography early satisfies SOC 2 CC6.1 (Encryption) and demonstrates proactive risk mitigation.
- Continuous static‑analysis findings become immutable evidence that development controls are operating as intended, simplifying control‑mapping for audit reviewers.
- Public benchmark data gives third‑party assessors a transparent view of your code‑security posture, supporting vendor‑risk due‑diligence.
Who Is Affected — Software development teams, SaaS providers, fintech, health‑tech, and any organization subject to SOC 2 that builds or maintains JVM‑based applications.
Recommended Actions
- Integrate Qodana into your CI/CD pipeline and map each crypto‑flag to the relevant SOC 2 encryption control.
- Archive scan reports as part of your continuous‑compliance evidence repository.
- Review flagged algorithms against NIST’s post‑quantum recommendations and replace any that fall below the highest security level.
Technical Notes — Qodana’s new inspection runs in the .NET linter by default, tracks untrusted data across files, and now includes five graded levels of post‑quantum crypto checks for JVM code. No CVE is involved; the feature is a proactive security control. Benchmark runs (including CodeQL and WebGoat.NET) are publicly accessible on a TeamCity server with guest login. Source: Help Net Security