A SpotBugs plugin for detecting security vulnerabilities in Java web and Android applications.
OWASP Find Security Bugs is a static analysis plugin for SpotBugs that detects security vulnerabilities in Java web applications and Android apps. It analyzes bytecode to identify common security flaws like injection vulnerabilities, hardcoded credentials, and cryptographic weaknesses. The tool helps developers find and fix security issues early in the development cycle.
Java developers, Android developers, and security engineers working on Java-based web applications or mobile apps who need to integrate security scanning into their development workflow.
It provides specialized security detection capabilities that extend the popular SpotBugs framework, offering comprehensive vulnerability coverage for Java ecosystems with seamless IDE and CI/CD integration.
The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Detects a wide range of vulnerabilities such as SQL injection and hardcoded passwords, with specific detectors like CUSTOM_INJECTION mentioned in the contributions section.
Offers plugins for Eclipse, IntelliJ IDEA, and Android Studio, as shown in the README screenshots and feature list for easy adoption in development environments.
Integrates with SonarQube and automated builds via Maven Central, supported by the project sponsors like GoSecure for continuous security scanning.
Works with Java, Kotlin, Groovy, and Scala, evidenced by contributions related to Scala and the Play Framework from developers like Maxime Nadeau.
Has notable contributors and sponsorship from GoSecure, ensuring ongoing development and research for new vulnerability classes, as highlighted in the README.
As a static analysis tool, it can produce false positives that require manual review, potentially slowing down development workflows if not properly configured.
Only supports Java-based languages, making it unsuitable for projects using other programming stacks or frameworks outside the JVM.
Requires setup and maintenance of the SpotBugs framework, adding complexity compared to standalone security scanners that might offer more integrated solutions.