Definition
Plain language
A commercial code-quality and static-analysis platform.
As stated in the literature
JetBrains' static analysis platform offering code-quality and security inspections; cited alongside Sourcegraph, Semgrep, and CodeQL as a code-graph-shaped tool potentially exposed to Oracle Poisoning.
Why it matters: Tools like Qodana sit deep in developer workflows, so if an AI agent can manipulate what they report, it can quietly hide bugs from the humans relying on them.
For example, a team might run Qodana on every pull request to flag unsafe casts or hard-coded secrets before code is merged.
Heard on the show
“The authors do an analysis of four other code-graph platforms — Sourcegraph, Semgrep, CodeQL, Qodana — and argue that the same preconditions exist there.”Episode 039 — When Smarter Agents Get Fooled by Three Extra Nodes in a Database