# find-sec-bugs/find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

Repository: https://github.com/find-sec-bugs/find-sec-bugs
Canonical: https://ross.abutalabs.com/products/find-sec-bugs
Homepage: https://find-sec-bugs.github.io/
Language: Java
License: LGPL-3.0
License Family: copyleft
Topics: findbugs, java, security-audit, owasp, taint-analysis, code-analysis, security, bytecode, cwe, static-analysis, hacktoberfest
Last push: 2026-03-26T05:29:48+00:00

## Health v2 (maintenance only)
Score: 56/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 74, release rhythm 8, longevity 100
- inputs: {"age_days": 5221, "days_push": 160, "days_rel": 442, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2437, forks 484 (observed 2026-08-28T04:06:51.453867+00:00)

## What it is
Find Security Bugs is a SpotBugs plugin that performs static security analysis of Java bytecode, detecting 144 vulnerability patterns including injections, crypto misuse, and hardcoded credentials. It also works with Kotlin, Groovy, and Scala, and integrates with IDEs, Maven, and CI systems like Jenkins and SonarQube.

## Use cases
- find security vulnerabilities in java web applications
- scan android app code for security bugs
- detect sql injection and other injection flaws via taint analysis
- find hardcoded passwords and crypto keys in code
- integrate security scanning into jenkins or sonarqube
- audit kotlin or scala projects for owasp top 10 issues
- run static security analysis in maven builds

## When to choose
- you need free, open-source SAST for JVM languages
- you already use SpotBugs, Maven, or an IDE like IntelliJ or Eclipse
- you want OWASP Top 10 and CWE-mapped findings with references
- you need taint analysis for injection vulnerabilities in Java web apps

## When to avoid
- you need dynamic analysis or runtime protection rather than static scanning
- your codebase is not on the JVM (e.g., pure Python, Go, or C)
- you need a commercial scanner with dedicated support and compliance reporting
- you want deep framework-specific coverage outside the supported Java frameworks

## Facets
- artifact type: plugin
- maturity: active
- function: security, vulnerability-scanning, linter, code-review, testing
- domain: security, developer-tools, web-development, mobile-development
- platform: jvm, cli, editor-plugin
- tags: spotbugs-plugin, static-analysis, taint-analysis, owasp, cwe, java-security, android-security, kotlin, scala, groovy, sast, android

## Member repositories
- find-sec-bugs/find-sec-bugs (main) score 56

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:51.453867+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:31:00.291180+00:00, confidence not recorded.
  - readme: https://github.com/find-sec-bugs/find-sec-bugs (fetched 2026-08-28T04:06:51.453867+00:00, sha cd7492e17474)
  - homepage: https://find-sec-bugs.github.io/ (fetched 2026-08-29T10:12:16.902558+00:00, sha 33137240b89c)
- Data as of 2026-08-30T08:39:29.467469+00:00.