SpotBugs

Visit Website

Introduction

SpotBugs is FindBugs’ successor: a static analysis tool that looks for bugs in Java code. It analyses compiled bytecode rather than source, which lets it reason about the program as the JVM sees it.

It ships hundreds of bug patterns, such as null pointer dereferences, infinite recursion, bad equals and hashCode implementations, resource leaks and concurrency mistakes, grouped by category and rank. Plugins extend it, most notably Find Security Bugs for security checks. Gradle, Maven, Ant and Eclipse integrations run it in builds and IDEs.

In the quality loop SpotBugs catches correctness bugs that source-level linters miss.

The source code is at spotbugs/spotbugs on GitHub under the LGPL-2.1 licence, with about 4,000 stars; the most recent commit was on 11 November 2026.

Features

1. Bytecode analysis: Works on compiled classes.
2. Hundreds of patterns: Correctness, performance, concurrency and more.
3. Ranks and confidence: Prioritise findings.
4. Plugins: Find Security Bugs and others.
5. Filters: Include and exclude files.
6. Build integrations: Gradle, Maven, Ant and IDEs.

Pros

1. Finds real bugs: Long track record from FindBugs.
2. Free to use: Open source under the LGPL-2.1 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 4,000 GitHub stars.

Cons

1. Needs compiled code: Runs after compilation.
2. False positives: Some patterns need suppression.
3. JVM only: Java and JVM bytecode.

Usage and Links (Example)

plugins { id("com.github.spotbugs") version "<latest>" }

./gradlew spotbugsMain

Resources:

• SpotBugs website
• GitHub repository

Pricing

SpotBugs is free and open source under the LGPL-2.1 licence.

Recommended for?

1. Java teams wanting bug-pattern detection.
2. Security-conscious teams adding Find Security Bugs.

Conclusion

SpotBugs remains one of the best ways to catch real Java bugs statically.

Run it in CI and suppress patterns deliberately.

On CheckOps, SpotBugs is filed under the Release & CI gates and Security testing stages. Related tools listed here include PMD, Checkstyle, Error Prone, Find Security Bugs, SonarQube and Infer. Before standardising on one, compare recent maintenance activity, the pricing model as your usage grows, and the integrations you rely on today. Information on this page was verified against the official website, documentation and repository on 11 November 2026.