PyCharm security plugins: keep Package Checker, drop 2021 lists

WhiteSource Advise is gone. Mend.io’s own JetBrains SAST plugin, Mend Advise Code, is marked no longer maintained, with a May 2026 successor note on the install page I opened. The control is the inspection that already ships in the IDE.

I opened the PyCharm npm help page and the Package Checker page dated 10 August 2026. Both say the plugin is bundled, enabled by default, and powered by Mend.io. That is the WhiteSource line with a new name and a first-party home. Keep the vulnerable versus malicious page next to this one. A CVE in the lockfile is homework. A malicious wheel is a remove. For the Python you write, read the Flask notes and input validation. Keep the secure coding checklist for the rest.

The 2021 seven aged in public

I checked each name from the old list against first-party pages on 22 August 2026. Comfort plugins that still exist are not promoted here. Dead security plugins are named so you can delete them.

JetBrains’ own August 2026 unbundle note starts with PyCharm 2026.2. The list is Data Wrangler, Hugging Face, Google Colab, Spark, AI Playground, AI Agents Debugger, dbt, and Databricks. Compatible 2026.2 builds stay installable. 2026.3 will stop publishing those.

Package Checker is already installed

You do not add WhiteSource. You stop disabling the plugin that replaced it. Settings, Plugins, Installed, Package Checker. The checkbox should be on. Inspections live under Editor, Inspections, Security. The names I opened on the IntelliJ page are Vulnerable declared dependency, Vulnerable API usage, and Malicious dependency.

Open requirements.txt or pyproject.toml. A flagged pin is highlighted. Alt+Enter offers a safe version, a Mend.io page, or an ignore. Ignoring writes into the inspection profile. Share that profile if the team must agree. Do not ignore a malicious wheel. The docs say remove it.

Analyze Code, Vulnerable Dependencies lists every declared and imported hit. The Problems tool window is the queue. Hover a call site for Vulnerable API usage when the library is pinned but the method you call is the bad one. That is a different ticket from “upgrade the pin.”

# requirements.txt  (example pins the IDE will highlight if Mend data says so)
# BAD: do not keep a known-bad pin to silence the inspection
# requests==2.31.0

# FIX: move to the version the inspection names, then lock it
requests==2.32.4

I am not claiming 2.32.4 is the forever pin. I opened the inspection on 22 August 2026 and used a current requests line as the named fallback. Re-run the inspection. Take the version it offers that day. Commit the lockfile.

On commit: Alt+0, Show Commit Options, enable Check malicious dependencies. That is the five-second control this page names. It covers npm and PyPI. A Flask app that also has a package.json for the frontend gets both.

requirements.txt     pin highlighted
                     Alt+Enter -> safe version

Problems tool        Vulnerable Dependencies tab
                     one row per CVE or malware name

Commit               Check malicious dependencies
                     ON. A hit blocks the push.

.ignore still exists. Secrets still leak

The idea-gitignore repo is an official JetBrains project. Release 4.5.7 is dated 19 January 2026. Marketplace id 7495 still resolves from that README. Install it if you want templates and highlighting for .gitignore, .dockerignore, and .npmignore. The control is the file, not the plugin chrome.

# .gitignore  (named fallback this page wants in every Python repo)
.env
.env.*
!.env.example
*.pem
*.p12
secrets/
.venv/
__pycache__/

PyCharm will still run without the plugin. Git will still honor .gitignore. The plugin marks matched files in the project view so a .env that is already tracked is visible. If Git already has the secret, delete it from history. Adding the ignore line does not unpublish a key.

SonarQube for IDE still flags the Python you wrote

SonarLint was renamed SonarQube for IDE. I opened the install page and the requirements page. Settings, Plugins, Marketplace, search SonarQube for IDE. Plugin id 7973. Restart the IDE. Standalone mode is free and analyzes as you type. Connected Mode syncs rules with a SonarQube or SonarQube Cloud project your team already runs.

This is the plugin that yells about your own functions: a pickle load, a shell=True, a Flask route that skips a login check. Package Checker yells about the pin. They do not replace each other. If the Marketplace search from inside an old IDE returns nothing, that IDE is unsupported. Upgrade PyCharm, then install.

I am not walking a Sonar rule catalog. Enable the plugin. Open a file you already know is sloppy. Fix what it names. Connected Mode is optional until the org has a server. Do not buy a server to feel busy if standalone already flags the sink.

Snyk only when the org already runs it

I opened the Snyk JetBrains docs. The install line still names plugin 10972. The docs page loaded. The plugin scans open-source pins, custom code, IaC, and secrets. It downloads the Snyk CLI. It wants a Snyk account, including the free plan.

Install it when snyk.io already files your tickets. Do not install it next to Package Checker and Sonar and then ignore two of the three panels. Two SCA sources on the same requirements.txt will disagree on severity. Pick the one your CI already gates on. If CI is Snyk, the IDE plugin is the early copy. If CI is nothing, start with Package Checker, which you already have.

Markdown, Docker, and the rest are not controls

I opened the Markdown help dated 25 June 2026. PyCharm recognizes .md without a Marketplace install. Preview, tables, and mermaid are editor features. They do not scan dependencies. Drop the 2021 “install Markdown” step.

I opened the Docker help. The Docker plugin is bundled and enabled by default in PyCharm Pro. Community still installs it. It pulls images and runs Compose. It is not a CVE scanner for those images. Treat it as a runner. Image scanning belongs in the registry or in CI, not in a 2021 “best plugins” sentence.

CSV, IdeaVim, and String Manipulation still exist as Marketplace plugins. Encoding a selection as MD5 Hex is not password storage. Sorting lines is not authorization. Leave them off a security shelf.

A plugin you install is code you run inside the IDE, with the same filesystem access as the editor. Prefer bundled JetBrains and vendors you already vendor-review. A random “Python security” listing with no org page is a supply-chain risk of its own.

Prove the inspection and the ignore file

You are not attacking a package index. You are proving the IDE would have stopped a flagged pin and a secret file.

1. Settings, Plugins, Installed: Package Checker is checked.
2. Editor, Inspections, Security: the three inspections above are on.
3. Open requirements.txt. Run Analyze Code, Vulnerable Dependencies. Save the Problems tab.
4. Commit tool window: Check malicious dependencies is on.
5. Confirm .gitignore lists .env. Confirm git check-ignore -v .env prints a line.

git check-ignore -v .env
# Expect: .gitignore:1:.env	.env

# Optional: SonarQube for IDE installed
# Settings - Plugins - Installed - "SonarQube for IDE"

A green Problems tab on a large Flask app is possible. Attach the empty report anyway. A hit you accepted needs an owner and a date. Then put the same gate in CI. The IDE is the early copy. Qodana uses the same Mend data if JetBrains already bills you for that.