Find Security Bugs review
An open-source JVM security plugin that adds framework-aware checks to SpotBugs workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Find Security Bugs is an open-source SpotBugs plugin for security audits of Java web and Android applications, with support for Kotlin, Groovy and Scala as well. It suits development teams that already use SpotBugs-based analysis and want security checks alongside that workflow. Detectors cover vulnerability patterns in JVM applications, including web application frameworks and libraries, and findings can reference OWASP Top 10 and CWE. It is a focused option for JVM teams, rather than a general-purpose scanner for a broader set of languages.
Its integration options fit common JVM development and delivery workflows. The plugin works with Eclipse, IntelliJ and Android Studio, and NetBeans; command-line use is available through Ant and Maven. Jenkins and SonarQube are supported for continuous integration. That breadth lets teams bring checks into IDE, build, and CI contexts, though the underlying SpotBugs dependency means it fits best where those tools are already part of the process. Teams looking for a standalone scanner or a customizable rule-writing workflow may prefer another product.
Find Security Bugs is free and open source, with self-hosted deployment. There are no paid tiers to compare in the published product details. The project is associated with OWASP, with development supported by GoSecure, and support channels are community and documentation. This makes it a practical choice for teams seeking no-cost security checks tied to existing JVM analysis. It is less suited to organizations that need custom rules or a deeper dedicated scan workflow; for those needs, a broader SAST product may be a better fit.
Find Security Bugs pros and cons
- Where it wins
- Checks Java, Kotlin, Groovy and Scala projects for security patterns
- Includes detectors for web application frameworks and libraries
- Works with major IDEs, Ant, Maven, Jenkins and SonarQube
- Where it doesn't
- Requires a SpotBugs-based workflow rather than operating as a standalone scanner
- Custom rules are not listed as supported
- Support is through community resources and documentation
Find Security Bugs fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update