Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Find Security Bugs

Free#23 of 25 in Static Application Security Testing Sast

Find Security Bugs: An open-source JVM security plugin that adds framework-aware checks to SpotBugs workflows. Ranked #23 of 25 in Static Application Security Testing Sast by our editors (6.9/10); pricing: Free plan; best for JVM teams needing free framework-aware checks.

6.9/10Editor score
Visit site
Find Security Bugs6.9 Visit site

At a glance

  • Editor score
    6.9 / 10
  • Pricing
    Free plan
  • Best for
    JVM teams needing free framework-aware checks
  • Free plan
    Yes
  • Paid from
    Free
  • IDE integration
    Yes
  • Facts checked
    24 Sep 2026

  • Where it wins

    • Checks Java, Kotlin, Groovy and Scala projects for security patterns
    • Includes detectors for web application frameworks and libraries
    • Works with major IDEs, Ant, Maven, Jenkins and SonarQube

  • Where it doesn't

    • Requires a SpotBugs-based workflow rather than operating as a standalone scanner
    • Custom rules are not listed as supported
    • Support is through community resources and documentation

Our verdict on Find Security Bugs

Find Security Bugs is an open-source SpotBugs plugin for security audits of Java web and Android applications, with support for Kotlin, Groovy and Scala as well. It suits development teams that already use SpotBugs-based analysis and want security checks alongside that workflow. Detectors cover vulnerability patterns in JVM applications, including web application frameworks and libraries, and findings can reference OWASP Top 10 and CWE. It is a focused option for JVM teams, rather than a general-purpose scanner for a broader set of languages.

Its integration options fit common JVM development and delivery workflows. The plugin works with Eclipse, IntelliJ and Android Studio, and NetBeans; command-line use is available through Ant and Maven. Jenkins and SonarQube are supported for continuous integration. That breadth lets teams bring checks into IDE, build, and CI contexts, though the underlying SpotBugs dependency means it fits best where those tools are already part of the process. Teams looking for a standalone scanner or a customizable rule-writing workflow may prefer another product.

Find Security Bugs is free and open source, with self-hosted deployment. There are no paid tiers to compare in the published product details. The project is associated with OWASP, with development supported by GoSecure, and support channels are community and documentation. This makes it a practical choice for teams seeking no-cost security checks tied to existing JVM analysis. It is less suited to organizations that need custom rules or a deeper dedicated scan workflow; for those needs, a broader SAST product may be a better fit.

Your product? Our editors can test Find Security Bugs in depth and publish a review, labelled as paid · from $149/mo →

Find Security Bugs pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on find-sec-bugs.github.io

Find Security Bugs fact sheet

Free planYes
Paid fromFree
Languages supported4 languages
IDE integrationYes
CI/CD integrationYes
DeploymentSelf-hosted
Custom rulesNo
Pull request scanningNot verified
DeploymentSelf-hosted
PlatformsWindows, macOS, Linux
SupportCommunity, Docs
Built forSolo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations8 integrations: Eclipse, IntelliJ, Android Studio, NetBeans, Ant, Maven …
PricingFree plan
Websitefind-sec-bugs.github.io
Facts checked24 Sep 2026

Find Security Bugs integrations

Find Security Bugs lists 8 integrations on its own site.

  • Eclipse
  • IntelliJ
  • Android Studio
  • NetBeans
  • Ant
  • Maven
  • Jenkins
  • SonarQube

Alternatives to Find Security Bugs

See all Find Security Bugs alternatives →

Used Find Security Bugs? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Find Security Bugs for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — Find Security Bugs 6.9/10

Find Security Bugs is listed in our Static Application Security Testing Sast directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/find-security-bugs/"><img src="https://www.itechguides.com/best/badge/find-security-bugs.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update