Meta Horizon

AI Security Review

Evidence context: threat category none; evidence quality strong.

This extension is a legitimate JetBrains plugin from Meta for their Horizon development platform. The analysis reveals no actual security concerns despite the high finding count.

Filesystem and Process Access Justification

The extension's class file paths confirm it is a development tool for Meta's Horizon platform, with components in com/horizon/plugin/ui/ for user interface elements, com/horizon/plugin/inspection/ for code inspection functionality, com/horizon/plugin/authentication/ for authentication handling, and com/horizon/plugin/telemetry/ for telemetry collection. These are standard components for an IDE plugin that provides development tooling. The QuestPermissionInspection class at com/horizon/plugin/inspection/QuestPermissionInspection$AndroidManifestQuickFix.class indicates the extension performs Android manifest permission inspections, which justifies read access to project files. The TelemetryConsentPanel class shows proper consent handling for telemetry collection.

Credential and Secret Access

Zero credential-related findings were detected. The findings summary shows "secret":"0" with no code-smell findings matching credential access patterns. The telemetry classes found (PluginEditorEvent, WelcomeDialogImpression, NoOpDeveloperTelemetry) are standard telemetry components that collect usage metadata, not source code or credentials. There are no findings indicating access to .env files, SSH keys, cloud credentials, or VS Code secret storage.

Strongest Counterargument

The two high-severity findings might suggest concern. However, without detailed evidence of what triggered these severities, and given that all 1,412 findings are metadata hashes on compiled Java class files with zero threat indicators (ioc=0, malware-signature=0, malware=0, obfuscation=0), this does not indicate malicious behavior. The findings are file hashes from the analysis pipeline, not security detections. Meta is a verified publisher on the JetBrains marketplace with 3,896 users, and the extension version (253.2.0.1.40) follows standard versioning for enterprise software.

Conclusion

This is a benign development tool. The high finding count is entirely metadata hashes from compiled Java bytecode, which is expected for any substantial IDE extension. No evidence of malicious behavior, credential theft, or data exfiltration exists.

Key Reasons

• Zero threat indicators across all security categories (ioc, malware, obfuscation, secret, network)
• All 1,412 findings are metadata hashes on compiled class files, not security detections
• Verified publisher (Meta) on official JetBrains marketplace with 3,896 users
• Class file paths indicate legitimate development tooling for Horizon platform

False Positive Considerations

• Metadata hashes on compiled Java class files counted as findings
• No actual security findings despite high total count
• Standard IDE plugin components flagged as findings

Reviewed 2026-05-24; recommended action: suppress false positive; model confidence 95%.