Find Security Bugs is a security analysis plugin for SpotBugs that identifies potential vulnerabilities in Java applications. It examines compiled bytecode to detect insecure programming practices and weaknesses that could expose applications to attack.
The tool is particularly useful for auditing web applications, Android applications and projects that use popular Java frameworks. It extends the capabilities of SpotBugs with security-specific detectors and data-flow analysis, helping developers identify problems before applications reach production.
Find Security Bugs can be incorporated into existing development workflows, allowing security checks to run alongside other code quality assessments. Its findings provide developers with information about the underlying weakness and references to established security classifications.
This is free and open source software.
Key Features
- Detects potential SQL injection, command injection, cross-site scripting and path traversal vulnerabilities.
- Taint analysis tracks untrusted data through application code to identify potentially dangerous operations.
- Identifies hard-coded passwords, cryptographic keys and other sensitive credentials.
- Detects insecure cryptographic algorithms, weak message digests and unsafe random number generation.
- Checks for XML External Entity vulnerabilities and other XML processing weaknesses.
- Identifies insecure deserialisation patterns and potentially unsafe object handling.
- Provides security detectors for frameworks including Spring MVC, Struts and Tapestry.
- Supports analysis of applications written in Java and other JVM languages, including Kotlin, Groovy and Scala.
- Recognises potentially vulnerable API calls and framework-specific security mistakes.
- Maps findings to Common Weakness Enumeration (CWE) classifications and OWASP security categories.
- Supports custom taint-analysis rules for identifying vulnerabilities involving application-specific APIs.
- Integrates with SpotBugs and compatible development environments, build tools and continuous integration systems.
- Provides descriptions and references to help developers investigate reported security weaknesses.
Website: github.com/find-sec-bugs/find-sec-bugs
Support:
Developer: Find Security Bugs contributors
License: GNU Lesser General Public License v3.0
Find Security Bugs is written in Java. Learn Java with our recommended free books and free tutorials.
Related Software
| Java Linter Tools | |
|---|---|
| SpotBugs | Find bugs in Java code |
| PMD | Extensible cross-language static code analyzer |
| Error Prone | Catch common Java mistakes |
| NullAway | Eliminate NPEs in Java code |
| Infer | Static analysis tool for Java, C++, Objective-C, and C |
| Checkstyle | Write Java code that adheres to a coding standard |
| Checker Framework | Pluggable type-checking for Java |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.