Tool integration

SpotBugs Integration Guide

Static analysis for JVM bytecode

Get a Free API Key

Integrate SpotBugs with Vulnetix. Find bugs in compiled JVM bytecode with SARIF output.

Java, Kotlin, Groovy, ScalaCLI toolSARIF

Install & scan

$ # Download from GitHub releases or use Gradle/Maven plugin
# Gradle: plugins { id 'com.github.spotbugs' version '6.0.0' }
$ spotbugs -sarif=spotbugs.sarif target/classes

Run SpotBugs in CI

Scan on every push and upload the results to Vulnetix:

- name: Build project
  run: mvn compile
- name: Run SpotBugs
  run: spotbugs -sarif=spotbugs.sarif target/classes
- name: Upload to Vulnetix
  run: vulnetix upload --file spotbugs.sarif

Centralise SpotBugs results in Vulnetix

Upload SpotBugs SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

SpotBugs documentation ↗  ·  Source repository ↗

Wire SpotBugs into your CI/CD pipeline →