How Qodana Enhances Code Quality and Security
Fullstack engineer Drew Penrod shares insights on integrating Qodana into DevOps workflows.
1Safe Phone Platform for Kids
Drew Penrod works as a fullstack engineer developing custom Android-based phones for children using Samsung Galaxy hardware. Their web interface lets parents control apps, contacts, screen time, and messaging. As the company scaled, maintaining code quality and security policies across multiple languages and repositories became critical.
2The DevSecOps Engineer's Role
Penrod bridges engineering teams with CI/CD pipelines, developer tools, and security controls. He builds internal services, conducts code reviews, and analyzes performance issues. He led Qodana adoption from evaluation to production. The team aligns with NIST Cybersecurity Framework and CIS Controls for child safety compliance.
3Code Quality Challenges
The team had style guides for TypeScript, Kotlin, and React, plus two-reviewer PR policies. However, ESLint ran inconsistently across repos. While Prettier and tests were reliable, static analysis gaps caused uneven standards. Growing language diversity made enforcing quality harder.
4Limits of Manual Reviews
Security vulnerabilities, license issues, and dependency risks required manual detection instead of pipeline automation. Two reviewers checked PRs against style guides, but this didn't scale. Missing static analysis increased production risks, especially for a kids' product requiring strict compliance.
5Child Safety & Compliance
The product's use on children's devices mandates alignment with CIS Controls v8 and NIST CSF 2.0. Control 7 enforces continuous vulnerability management, while Control 16 requires static analysis and secure coding. Qodana automates checks for every change, fulfilling these framework requirements.
6Qodana's Advantages
Qodana consolidates static analysis, dependency scanning, style checks, and license audits in one platform. It integrates with JetBrains IDEs and CI pipelines, letting developers catch issues pre-commit. Shared pipeline mechanisms simplify repository onboarding while maintaining consistent rules.
7Phased Adoption Process
Qodana was incrementally integrated into PR and main branch pipelines. Each repo got a baseline to separate legacy and new findings. Soft gates are in pilot testing, with hard gates limited by CI platform constraints. Gradual rollout ensures smooth adaptation across teams.
8Early Wins & Impact
Visibility into PR and IDE findings delivered value before enabling gates. Centralized tracking of dependency vulnerabilities and license issues improved update triage. Consistent quality standards across a polyglot codebase enhance both product security and developer productivity.
Original article: The JetBrains Blog — Qodana ile Yazılım Kalitesi ve Güvenliği Nasıl Artırılır?