SAST Scan with SpotBugs + Find Security Bugs (Java)

When to use

Prerequisites

• SpotBugs installed with Find Security Bugs plugin
• Maven: add

  spotbugs-maven-plugin

  +

  findsecbugs-plugin

  to

  pom.xml

• Gradle: add

  com.github.spotbugs

  plugin +

  findsecbugs-plugin

  dependency
• Verify:

  spotbugs -version

Instructions

1. Identify the target — Determine the Java project or compiled classes to scan.
2. Run the scan:
   Maven:
   bash

   mvn spotbugs:check -Dspotbugs.plugins=com.h3xstream.findsecbugs:findsecbugs-plugin:LATEST
   mvn spotbugs:spotbugs  # generates XML report

   Standalone CLI:
   bash

   spotbugs -textui -effort:max -low \
     -pluginList findsecbugs-plugin.jar \
     -xml:withMessages -output spotbugs-results.xml \
     ./target/classes

3. Parse the results — Read the XML output and present findings:

| # | Priority | Category | Bug Type | Class:Line | Finding | Remediation |
|---|----------|----------|----------|------------|---------|-------------|

1. Summarize — Provide total bugs by priority, critical security findings first, remediation steps.

Key Find Security Bugs Categories