Some Java SAST tools analyze compiled bytecode, others analyze source, and several do both. If a tool works on compiled classes, it needs a successful build first, which affects where you run it in CI and how fast feedback arrives.
Source analysis versus bytecode analysis
SpotBugs, a free static analysis tool for Java, states that it can analyze programs compiled for any version of Java, which indicates it works on compiled programs. It checks for more than 400 bug patterns, runs on JRE or JDK 11 or later, and supports extensions that add detectors, including the find-sec-bugs security plugin.
| Approach | Needs a build | Strength | Weakness |
|---|---|---|---|
| Source analysis | Often not | Fast, works on partial code | Weaker on resolved types and libraries |
| Bytecode analysis | Yes | Sees resolved types and generated code | Slower, needs working build |
| Both | Depends | Broadest view | More setup |
What Java SAST typically flags
- SQL built by string concatenation instead of prepared statements.
- Unsafe deserialization of untrusted streams. See Java deserialization allowlists.
- XML parsers with external entities enabled.
- Weak or misused cryptography.
- Path traversal and command execution from input.
- Hardcoded passwords.
Frameworks matter. Injection in a Spring controller or a servlet is traced through framework annotations, so check the tool supports the framework you use. See checking SAST language and framework coverage.
Steps
- Make sure the project builds in a clean CI environment. This is the most common blocker.
- Run the scan after the compile step and keep the build outputs available to the scanner.
- Start with a baseline and fail only on new high severity findings.
- Review the framework specific findings first, since they are usually the most real.
- Add dependency scanning for Maven or Gradle. Most Java risk lives in libraries.
Common blockers
Generated sources that are not on the path, multi module builds scanned module by module, and private repositories the CI cannot reach. Each causes missed code without an obvious error, so compare the file count scanned with the file count you expect.
How Safeguard helps
Safeguard provides SBOM and dependency scanning with reachability analysis, and policies, gates and guardrails you can apply before merge. You can try the free scan on a repository.
Quick check
Why does my Java scan say nothing was analyzed?
Often the build did not run or the compiled output was not available to the scanner. Check the build step first.
Is source analysis worse than bytecode analysis?
Not worse, different. Source analysis is faster; bytecode analysis sees resolved types. Many teams use both.
Sources
- SpotBugs project site (fetched 19 October 2026): bug patterns, JRE requirement, plugin support.
Last reviewed: 19 October 2026.
