Drew Penrod, a fullstack/DevSecOps engineer at a kids' phone company, shares his experience adopting JetBrains Qodana for code quality enforcement across a polyglot codebase. Before Qodana, the team had written style guides for TypeScript, Kotlin, and React but lacked consistent automated enforcement — ESLint ran inconsistently, and static analysis was absent from CI. Qodana was chosen over SonarQube and standalone SCA tools because it covers static analysis, dependency scanning, license auditing, and style checks in one platform, running the same inspections in JetBrains IDEs and CI pipelines. Rollout has been incremental using shared pipeline mechanisms and per-repo baselines. So far, Qodana has surfaced ~99,000 issues across the codebase, providing visibility into dependency vulnerabilities and license risks that previously went untracked. The team is working toward CIS Controls v8 and NIST CSF 2.0 alignment, with soft gates in pilot and hard gates planned once rollout completes.
