HTTP/2 301 server: GitHub.com content-type: text/html location: https://h3xstream.github.io/find-sec-bugs/ x-github-request-id: 932D:36A0B4:40EB43:47CCC2:694D113E accept-ranges: bytes age: 0 date: Thu, 25 Dec 2025 10:26:06 GMT via: 1.1 varnish x-served-by: cache-bom-vanm7210068-BOM x-cache: MISS x-cache-hits: 0 x-timer: S1766658366.306137,VS0,VE197 vary: Accept-Encoding x-fastly-request-id: d4f4d1eb0de9feac36157f192ca4327c85bba53c content-length: 162 HTTP/2 200 server: GitHub.com content-type: text/html; charset=utf-8 last-modified: Sat, 05 Dec 2015 20:03:54 GMT access-control-allow-origin: * etag: W/"5663432a-3ec0" expires: Thu, 25 Dec 2025 10:36:06 GMT cache-control: max-age=600 content-encoding: gzip x-proxy-cache: MISS x-github-request-id: 94AA:2D64E0:403C6D:471CC1:694D113D accept-ranges: bytes date: Thu, 25 Dec 2025 10:26:06 GMT via: 1.1 varnish age: 0 x-served-by: cache-bom-vanm7210068-BOM x-cache: MISS x-cache-hits: 0 x-timer: S1766658367.524507,VS0,VE213 vary: Accept-Encoding x-fastly-request-id: af74e310829018ac72f73d1f25ab875c2530bdcd content-length: 3748

Features

78 bug patterns

It can detect 78 different vulnerability types with over 200 unique signatures.

Support your frameworks and libraries

Cover popular frameworks including Spring-MVC, Struts, Tapestry and many more.

Integrate with your IDE

Plugins are available for Eclipse, IntelliJ, Android Studio and NetBeans. Command line integration is available with Ant and Maven.

Continuous integration

Can be used with systems such as Jenkins and SonarQube.

OWASP TOP 10 and CWE coverage

Extensive references are given for each bug patterns with references to OWASP Top 10 and CWE.

Open for contributions

The project is open-source and is open for contributions.

Screenshots

Eclipse

IntelliJ / Android Studio

Sonar Qube