@hmatche - as Sarah quoted in her post, the security issues revolve around built-in web server and over permissive CORS settings which allowed unauthorized access to internal API endpoints. I don't believe PHPStorm is open source so there likely isn't any public source code to look at.