CheckOps home

Tools directory

F

CheckOps

Find Security Bugs

Find Security Bugs is the LGPL-3.0 SpotBugs plugin for security audits of Java web and Android applications, also working with Kotlin, Groovy and Scala projects.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Find Security Bugs is a SpotBugs plugin for security audits of Java web applications and Android applications. It also works with Kotlin, Groovy and Scala projects because it analyses JVM bytecode.

The source code is at find-sec-bugs/find-sec-bugs on GitHub under the LGPL-3.0 licence, with about 2,500 stars; the most recent commit was on 3 November 2026.

Features

  1. Bytecode analysis: Works across JVM languages.
  2. Security detectors: Injection, crypto, XSS, path traversal and more.
  3. IDE and build integration: Maven, Gradle, Ant and IDE plugins via SpotBugs.
  4. Android support: Checks for Android apps.
  5. SARIF and XML output: Through SpotBugs reports.

Pros

  1. Free to use: Open source under LGPL-3.0.
  2. Maintained: Commits as recent as 3 November 2026.

Cons

  1. Needs compiled code: Runs on bytecode, so you must build first.
  2. SpotBugs dependency: Setup goes through SpotBugs.

Add the plugin to the SpotBugs Maven or Gradle configuration (see the website for coordinates), then run:

mvn spotbugs:check

Resources:

Pricing

Find Security Bugs is free and open source under the LGPL-3.0 licence.

  1. Java teams already using SpotBugs.
  2. Android developers wanting security checks.
  3. Not a fit for non-JVM languages.

Conclusion

Find Security Bugs adds solid security detectors to SpotBugs for JVM projects.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Find Security Bugs side by side.