Projects sharing features with Spotbugs

Gixy is a static configuration analyzer and security auditor for Nginx. It functions as an infrastructure-as-code security scanner and web server configuration linter designed to identify vulnerabilities and misconfigurations in server definitions before deployment. The tool focuses on detecting high-risk security flaws, including host header spoofing, server-side request forgery, and path traversal. It specifically audits Nginx configurations for risks such as HTTP splitting, multiline header issues, and unauthorized third-party access resulting from incorrect Referer or Origin header patter

Recaf is a suite of specialized tools for assembling, editing, deobfuscating, decompiling, and instrumenting Java bytecode and runtime processes. It provides a coordinated environment for modifying compiled Java class files and analyzing the behavior of Java applications. The project distinguishes itself through a multi-level abstraction layer that allows for editing across different formats and a pluggable framework that routes bytecode through multiple configurable decompilation engines. It includes an embedded scripting engine and plugin architecture to automate repetitive tasks and extend

Javassist is a bytecode engineering toolkit for analyzing, modifying, and generating Java bytecode and class files. It functions as a bytecode manipulation library that allows for the editing of class files through either direct bytecode access or high-level source code syntax. The project provides specialized tools for the programmatic creation of new Java classes and interfaces during runtime. It includes a dynamic proxy generator for intercepting method calls and a class loader interceptor that automatically modifies class definitions as they are loaded into the Java Virtual Machine. Addi

Cppcheck is a static analysis tool and linter for C and C++ source code designed to detect programming errors, memory leaks, and security violations without executing the program. It functions as a bug detection engine and quality assurance tool to identify concurrency issues, type cast errors, and compliance with secure coding standards. The project provides a graphical user interface for selecting files and reviewing errors, alongside a linter for enforcing naming conventions and coding standards. It supports the creation of custom analysis rules using regular expressions to identify specif

This project is a static analysis tool and linter for Ruby on Rails designed to identify architectural smells and violations of best practices. It serves as a code quality linter, architectural auditor, security scanner, and performance analyzer for Rails applications. The tool evaluates the separation of concerns between controllers, models, and view templates to reduce technical debt. It identifies suboptimal coding patterns and enforces stylistic consistency, while specifically scanning for security vulnerabilities such as unprotected mass assignment in models. The analysis surface covers

This project is an educational resource providing a collection of executable Java code examples designed to demonstrate common multi-threading pitfalls and synchronization failures. It serves as a practical guide for developers to identify and debug issues such as race conditions, memory visibility problems, and deadlocks within concurrent software environments. The repository distinguishes itself by offering reproducible scenarios that simulate complex concurrency hazards, including structural corruption in non-thread-safe collections and cyclic dependencies between threads. By executing the

This project is an ESLint plugin and static analysis tool designed to enforce best practices, prevent bugs, and maintain code quality in React projects. It functions as a specialized JSX linter that analyzes the syntax and structure of components to detect anti-patterns and API misuse. The plugin distinguishes itself by providing deep analysis of React-specific patterns, such as detecting state race conditions, preventing nested component definitions, and identifying unstable references that cause unnecessary re-renders. It also includes security hardening rules to identify vulnerabilities li

Luau is a high-performance programming language evolved from Lua 5.1. It consists of a bytecode virtual machine, an embeddable scripting engine, and a static code analyzer designed to provide a secure, sandboxed execution environment for host applications. The project is distinguished by its gradual typing system, which combines automatic type inference with optional manual annotations to detect bugs without requiring full static typing. It also features native vector mathematics for high-performance operations and a specialized debugging system that uses bytecode patching to minimize executi

Error Prone is a static code analyzer and Java compiler extension that identifies common programming mistakes during the build process. It functions as a compiler wrapper that flags potential errors as compile-time failures to prevent bugs from reaching execution. The tool integrates directly into the Java compilation workflow to provide compile-time validation. It allows for the definition of custom linting rules and analysis checks to enforce specific coding standards and detect prohibited API usage. The system utilizes abstract syntax tree analysis and type-aware pattern matching to inspe

Bandit is a static analysis security testing tool and vulnerability detection scanner for Python source code. It functions as a security-focused linter and static analyzer that identifies common vulnerabilities and architectural flaws without executing the program. The tool utilizes an abstract syntax tree to analyze code patterns and identifies risky function calls or insecure configurations. It employs a plugin-based rule engine to decouple scanning logic from individual security checks and supports configuration-driven filtering to exclude specific files or ignore certain warnings. The sy

RuboCop is a static code analyzer and linter for Ruby. It functions as a static analysis tool designed to detect potential bugs, identify style violations, and improve overall code quality in Ruby projects. The project provides an automated code formatter that rewrites source code to align with established community standards. It also implements a language server protocol to surface linting and formatting errors directly within text editors. Its capabilities cover automated code linting and the analysis of Ruby code style to ensure consistency across a project. These functions are driven by

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

JaCoCo is a Java code coverage tool and bytecode instrumenter that measures which parts of source code are executed during tests. It functions as a runtime agent to monitor application execution on the fly or as a library for offline bytecode instrumentation, allowing it to capture execution data in environments where runtime agents are restricted. The project distinguishes itself by providing both dynamic and static instrumentation paths to track execution. It includes a runtime agent for on-the-fly monitoring and the ability to modify compiled class files before execution. It further enable

isort is a Python import sorter and code formatter that organizes import statements into alphabetical groups and sections. It functions as both a utility to automatically rearrange imports for a consistent layout and as a linting tool to verify if code follows specific ordering rules. The project provides configurable layout settings for indentation, wrapping modes, and section ordering to ensure compliance with project style guides and PEP 8. It allows for the exclusion of specific lines or files through inline comments and docstrings. The tool integrates into development workflows via IDE

p3c is a Java static analysis tool and code quality linter designed to enforce professional coding guidelines and quality standards. It utilizes a set of custom rules based on the PMD engine to scan source code for style violations, performance bottlenecks, and potential bugs. The project is distributed as an IDE linting plugin that provides real-time feedback and warnings during development. It also includes functionality for pre-commit code quality gates, allowing modified files to be scanned and blocked if they violate defined rules before being committed to version control. The analysis

Vulture is a static analysis tool and linter designed to find unused variables, functions, and classes in Python source code. It operates as a dead code detector and unused code finder that scans source files to identify unreachable expressions and imports without executing the code. The tool employs a confidence-based heuristic scoring system to assign probability values to detections, helping to distinguish truly unused symbols from potential false positives. It further assists in pruning dead logic by sorting detected unused classes and functions by line count to prioritize the removal of

This project is a comprehensive, curated directory of static analysis, linting, and security scanning utilities. It serves as a central resource for developers to discover, compare, and select tools based on specific programming languages, licensing models, and integration requirements. The directory distinguishes itself by providing deep metadata for each listed utility, including community-driven popularity rankings, maintenance status, and deployment methods. By aggregating these tools into a single searchable index, it enables teams to identify solutions for enforcing coding standards, ma

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

React is a JavaScript library for building user interfaces based on a component-driven architecture and unidirectional data flow.

Bearer is a static analysis security testing tool and privacy compliance auditor. It identifies security vulnerabilities, hard-coded secrets, and privacy risks in source code through static analysis and data flow tracing. The tool distinguishes itself by tracking the movement of sensitive data through code to identify leaks and by mapping personal and health-related information flows to generate evidence for privacy impact assessments. It also provides differential scanning for pull requests and uses fingerprint-based suppression to exclude known false positives from reports. The platform co

CodeQL is a semantic code analysis engine and vulnerability scanning tool that treats source code as data. It utilizes a static analysis query language to define complex patterns and security vulnerabilities within a code graph database. The system represents source code as a relational database, enabling the execution of structural queries and data flow analysis. This approach allows for the detection of security flaws and coding errors across large-scale repositories. The tool provides capabilities for automated code auditing, static analysis security testing, and custom vulnerability dete

Luyten is an open source Java decompiler and bytecode analyzer designed to transform compiled class files back into high-level source code. It functions as a graphical user interface for the Procyon decompilation engine, allowing for the inspection and recovery of program logic from Java bytecode. The tool provides capabilities for Java reverse engineering and legacy code analysis, enabling the examination of third-party applications or libraries when original source code is unavailable. The system includes a desktop interface for browsing class hierarchies, recursive classpath scanning to

Brakeman is a static analysis security tool and scanner specifically designed for Ruby on Rails source code. It identifies common security vulnerabilities, such as injection and cross-site scripting, by analyzing the application codebase without executing the application. The tool functions as a security auditor that detects mass assignment risks and template vulnerabilities. It evaluates the final output of rendered views and identifies unrestricted assignment patterns that could allow unauthorized modification of model attributes. The system provides vulnerability management through the us

vjtools is a comprehensive Java development toolset and runtime monitor designed for optimizing application performance and ensuring codebase consistency. It provides a suite of JVM diagnostics tools, a performance profiler, and a static analysis system for enforcing coding standards. The project distinguishes itself through specialized runtime observability, including the ability to attach to processes via process ID and inject dynamic probes to monitor method calls without restarting the system. It features container-aware resource detection that reads control group files to report actual C

This repository serves as a comprehensive educational resource for mastering multi-threaded development and high-performance task coordination within the Java ecosystem. It provides technical guidance on implementing thread-safe data structures and synchronization primitives to ensure data integrity and prevent race conditions in complex applications. The material covers essential strategies for building scalable and fault-tolerant backend systems. It details the integration of asynchronous message queues for component decoupling, the application of circuit breakers to maintain service resili

Web-check is a self-hosted diagnostic platform designed to perform comprehensive technical reconnaissance and security audits on web domains. It functions as a network scanner that inspects infrastructure by querying IP addresses, DNS records, SSL certificate chains, and server headers to identify potential misconfigurations or vulnerabilities. The platform is built to run within private infrastructure, ensuring that site investigations remain independent of external tracking or third-party data logging. By utilizing server-side request proxying, the tool bypasses client-side security restric