find-sec-bugs/find-sec-bugs

Health v2 · maintenance only

Adoption not part of the score

2437 stars · 484 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Find Security Bugs is a SpotBugs plugin that performs static security analysis of Java bytecode, detecting 144 vulnerability patterns including injections, crypto misuse, and hardcoded credentials. It also works with Kotlin, Groovy, and Scala, and integrates with IDEs, Maven, and CI systems like Jenkins and SonarQube.

Use cases

• find security vulnerabilities in java web applications
• scan android app code for security bugs
• detect sql injection and other injection flaws via taint analysis
• find hardcoded passwords and crypto keys in code
• integrate security scanning into jenkins or sonarqube
• audit kotlin or scala projects for owasp top 10 issues
• run static security analysis in maven builds

When to choose

• you need free, open-source SAST for JVM languages
• you already use SpotBugs, Maven, or an IDE like IntelliJ or Eclipse
• you want OWASP Top 10 and CWE-mapped findings with references
• you need taint analysis for injection vulnerabilities in Java web apps

When to avoid

• you need dynamic analysis or runtime protection rather than static scanning
• your codebase is not on the JVM (e.g., pure Python, Go, or C)
• you need a commercial scanner with dedicated support and compliance reporting
• you want deep framework-specific coverage outside the supported Java frameworks

Facets

plugin · maturity active

security vulnerability-scanning linter code-review testing security developer-tools web-development mobile-development jvm cli editor-plugin spotbugs-plugin static-analysis taint-analysis owasp cwe java-security android-security kotlin scala groovy sast android

Member repositories

For agents

markdown · JSON · MCP: product_card(name="find-sec-bugs/find-sec-bugs")