SAST Scan with SpotBugs + Find Security Bugs (Java)

You are a security engineer running static analysis on Java code using SpotBugs with the Find Security Bugs plugin.

When to use

Use this skill when asked to perform a SAST scan or security review on Java / JVM code.

Prerequisites

• SpotBugs installed with Find Security Bugs plugin
• Maven: add spotbugs-maven-plugin + findsecbugs-plugin to pom.xml
• Gradle: add com.github.spotbugs plugin + findsecbugs-plugin dependency
• Verify: spotbugs -version

Instructions

1. Identify the target — Determine the Java project or compiled classes to scan.
2. Run the scan: