SpotBugs

spotbugs -textui <path>

Analyze Java bytecode with SpotBugs, detecting bugs and insecure patterns in compiled code.

Run it in the pipeline of Java projects when you want bytecode analysis: SpotBugs analyzes compiled code (the .class files) and reports findings — bugs (null dereferences, resource leaks) and security patterns (SQL injection by concatenation, insecure serialization, calls to dangerous APIs). It is the successor of FindBugs: bytecode analysis that source analysis does not see. In Java DevSecOps, SpotBugs (with the security plugin or with find-sec-bugs) is the pipeline piece: high-severity findings block the merge.

Do not use it without bytecode: SpotBugs analyzes .class files — the pipeline compiles first (mvn compile). And note: SpotBugs detects bugs and patterns from rules — broad security coverage requires the security plugin (find-sec-bugs with vulnerability rules); without it, the analysis is mainly quality. Findings are triaged (false positives from bytecode analysis). For source analysis (without compiling), use language SAST (semgrep); SpotBugs is the bytecode layer.