Maven – SpotBugs example

In this article, we will show you how to use SpotBugs Maven Plugin to find bugs in Java code.

Findbugs is no longer maintained, and thus SpotBugs is the spiritual successor of FindBugs

P.S SpotBugs requires JDK 1.8

1. Maven SpotBugs Plugin

Define the spotbugs-maven-plugin in the reporting tag. So that mvn site will generate the SpotBugs report.



2. Java Code

A simple Java code, with an unused field ‘abc’ and a performance issue in the “+ string” loop. Later, SpotBugs will be able to detect it and showing it on the report.

package com.mkyong.examples;

public class StaticCodeExample {

    //Unused field
    private int abc;

    private String ip = "";

    public void test() {

        String[] field = {"a", "b", "c", "s", "e"};

        //concatenates strings using + in a loop
        String s = "";
        for (int i = 0; i < field.length; ++i) {
            s = s + field[i];




3. Maven Site

mvn compile site to generate a Maven site for the Java project, the SpotBugs report will be generated and integrated into the Maven site automatically.

$ mvn compile site

[INFO] Generating "SpotBugs" report      --- spotbugs-maven-plugin:3.1.8:spotbugs
[INFO] Generating "Dependency Information" report --- maven-project-info-reports-plugin:3.0.0:dependency-info
[INFO] Generating "About" report         --- maven-project-info-reports-plugin:3.0.0:index
[INFO] Generating "Plugin Management" report --- maven-project-info-reports-plugin:3.0.0:plugin-management
[INFO] Generating "Plugins" report       --- maven-project-info-reports-plugin:3.0.0:plugins
[INFO] Generating "Summary" report       --- maven-project-info-reports-plugin:3.0.0:summary
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  7.732 s
[INFO] Finished at: 2018-11-19T15:38:56+08:00
[INFO] ------------------------------------------------------------------------

4. SpotBugs Report

Review the report at target/site/spotbugs.html

5. FAQs

5.1 Review the SpotBugs 400 bug patterns here.

5.2 More Maven SpotBugs Plugin recipes here

Download Source Code

$ git clone
$ cd maven-static-code-analysis
$ mvn compile site

# view report at target/site/spotbugs.html


  1. SpotBugs Official site
  2. SpotBugs Maven Plugin
  3. Using the SpotBugs Maven Plugin
  4. List of tools for static code analysis
author image


Founder of, love Java and open source stuff. Follow him on Twitter. If you like my tutorials, consider make a donation to these charities. Read all published posts by


newest oldest most voted
Alex Zubkov
Alex Zubkov

So… Is that project dead or what? All sources are deadlinked…


hi i have doubt in spotbugs tool?
can we customize the report?