SAST · Java / Spring

Static application security testing for Java and Spring

Offensive360 SAST follows untrusted data through Spring controllers, services, repositories and views, and reports the exact source-to-sink flow with a secure fix. It runs in IntelliJ, in Maven and Gradle pipelines and on-premise, so source never leaves your network.

Scan a Java repository in a demo Free for open-source Java projects

Last updated: 8 September 2026

What it finds in Java code

Findings map to OWASP Top 10, CWE and SANS Top 25. Each one carries the cross-file trace and a fix in idiomatic Java.

SQL, JPQL and HQL injection

Request data concatenated into JDBC Statement, EntityManager.createQuery, Hibernate createQuery and Spring JdbcTemplate strings; prepared statements and bound parameters are recognized as safe.

Cross-site scripting in JSP, Thymeleaf and REST responses

Unescaped expressions, th:utext, out.print of request values and JSON written into script blocks; framework escaping is modelled so encoded output is not reported.

Insecure deserialization

ObjectInputStream on untrusted streams, XStream and XMLDecoder, Jackson default typing and known gadget-chain entry points.

XXE, XPath and LDAP injection

DocumentBuilderFactory, SAXParser and XMLInputFactory without secure processing, plus user input inside XPath and LDAP filters.

Command injection and path traversal

Runtime.exec and ProcessBuilder with request-controlled arguments, and File or Paths.get fed by parameters without normalization.

SSRF and open redirects

URL, HttpClient, RestTemplate and WebClient targets built from user input; sendRedirect and Spring redirect: views with unvalidated destinations.

Hardcoded secrets and configuration

Passwords, tokens and keys in application.properties, application.yml, source and test fixtures, with a fix that moves them to environment or vault configuration.

Broken access control in Spring Security

Missing @PreAuthorize on sensitive endpoints, permissive antMatchers ordering, CSRF disabled on session-based apps and insecure CORS configuration.

Weak cryptography and randomness

MD5, SHA-1, DES, ECB mode, static IVs, java.util.Random for tokens, and TrustManagers or HostnameVerifiers that accept everything.

A finding, as the developer sees it

SQL injection (CWE-89), high severity. Source: the customer request parameter. Sink: a concatenated query passed to JdbcTemplate. The fix binds the value as a parameter.

Vulnerable

@GetMapping("/orders")
public List<Order> orders(@RequestParam String customer) {
    String sql = "SELECT * FROM orders WHERE customer = '" + customer + "'";
    return jdbcTemplate.query(sql, orderMapper);
}

Secure fix

@GetMapping("/orders")
public List<Order> orders(@RequestParam String customer) {
    String sql = "SELECT * FROM orders WHERE customer = ?";
    return jdbcTemplate.query(sql, orderMapper, customer);
}

Where it runs

IntelliJ IDEA, Android Studio, Eclipse, VS Code

Findings appear inline with the taint path and secure fix while you write code, for Java and Kotlin projects.

Maven and Gradle pipelines

Scan on pull request in GitHub Actions (SARIF), GitLab CI, Bitbucket, Azure DevOps, Jenkins or CircleCI; fail the build on new high findings.

Dependency analysis for Maven and Gradle

The same run lists vulnerable Maven artifacts (Log4j, Spring4Shell class issues, Jackson, Struts) and license risks.

On-premise or air-gapped

OVA appliance, Azure image inside your subscription, or fully offline. Source never leaves the network; no build or package restore required to scan.

Questions from Java teams

Which Java frameworks and versions are covered?

Java 8 through Java 25 and Kotlin: Spring Boot, Spring MVC, Spring Security, Spring Data and WebFlux, Jakarta EE and Java EE (Servlets, JSP, JAX-RS, EJB), Struts, JSF, Hibernate and JPA, Vert.x, Micronaut, Quarkus and Android. Scala and Groovy code in the same repository is analyzed as well.

Does it need to compile the project first?

No. Offensive360 SAST parses the source directly, so scans run without Maven or Gradle resolving dependencies. That keeps CI scans fast and makes air-gapped scanning practical.

How does it compare to SpotBugs, Find Security Bugs or SonarQube?

Those tools check bytecode or single files for known patterns. Offensive360 follows data across controllers, services and repositories with interprocedural taint analysis, understands sanitizers and framework encoders, and provides a fix for each finding. Our Java vulnerabilities guide walks through the difference on real code.

Can it scan Android apps?

Yes, in two ways. SAST analyzes Kotlin and Java source, including intents, WebView settings, storage and network code. MAST analyzes the built APK or AAB against the OWASP Mobile Top 10 (2024) without source access.

Can I try it on our own code?

Yes. A scoped demo scans a repository you choose, on-premise or in our cloud, and reviews the findings with your team. Public open-source Java projects can request a free scan token.

Guides for Java security

See the findings on your own code

A 30-minute scoped demo: we scan a Java repository you choose and review the traces and fixes together.

Book a demo SAST for C# and .NET All 60+ languages