* FindBugs looks for bugs in Java programs. It is based on the concept of bug patterns. A bug pattern is a code idiom that is often an error. Bug patterns arise for a variety of reasons: * Difficult language features Misunderstood API methods Misunderstood invariants when code is modified during maintenance Garden variety mistakes: typos, use of the wrong boolean operator * FindBugs uses static analysis to inspect Java bytecode for occurrences of bug patterns. Static analysis means that FindBugs can find bugs by simply inspecting a program's code: executing the program is not necessary. This makes FindBugs very easy to use: in general, you should be able to use it to look for bugs in your code within a few minutes of downloading it. FindBugs works by analyzing Java bytecode (compiled class files), so you don't even need the program's source code to use it. Because its analysis is sometimes imprecise, FindBugs can report false warnings, which are warnings that do not indicate real errors. In practice, the rate of false warnings reported by FindBugs is less than 50%. * FindBugs supports a plugin architecture allowing anyone to add new bug detectors. The publications page contains links to articles describing how to write a new detector for FindBugs. If you are familiar with Java bytecode you can write a new FindBugs detector in as little as a few minutes. * FindBugs is free software, available under the terms of the Lesser GNU Public License. It is written in Java, and can be run with any virtual machine compatible with Sun's JDK 1.5. It can analyze programs written for any version of Java. FindBugs was originally developed by Bill Pugh and David Hovemeyer. It is maintained by Bill Pugh, and a team of volunteers. * FindBugs uses BCEL to analyze Java bytecode. As of version 1.1, FindBugs also supports bug detectors written using the ASM bytecode framework. FindBugs uses dom4j for XML manipulation.

* Built-in support for Google Android, Spring, Hibernate, Eclipse plug-ins, TDD, JDBC, EJBs, and more (mobile, embedded, Java EE...) * Integrates with Parasoft SOAtest for end-to-end functional and load testing for web, SOA, and cloud development. * Exposes runtime defects that occur as the application is exercised by unit, manual, or scripted tests–including race conditions, exceptions, resource leaks, and security attack vulnerabilities * Without requiring execution, identifies execution paths that can trigger runtime defects * Checks compliance to configurable sets of over 1000 built-in static analysis rules for Java * Provides templates for OWASP Top 10, CWE-SANS Top 25, PCI DSS, and other security static standards * Allows easy GUI-based customization of built-in rules * Identifies and prevents concurrency defects such as deadlocks, race conditions, missed notification, infinite loops, data corruption other threading problems * Automatically creates robust low-noise regression test suites–even for large code bases * Execute tests created in any open-format unit testing tool, including out-of-the-box support for JUnit- and TestNG– based testsIntegrates and extends manually-written unit test cases * Continuously executes the test suite to identify regressions and unexpected side effects * Performs runtime error detection as tests execute * Parameterizes test cases for use with varied, controlled test input values (runtime-generated, user-defined, or from data sources) * Monitors test coverage with multiple metrics * Tracks code coverage from manual tests and test scripts * Steps through tests with the debugger * Tests individual methods, classes, or large, complex applications * Calculates metrics such as Inheritance Depth, Lack Of Cohesion, Cyclomatic Complexity, Nested Blocks Depth, Number Of Children * Identifies duplicate and unused code * Shares test settings and files team-wide or organization-wide * Generates HTML, PDF, XML, and custom reports - Tracks how test results and code quality change over time - Provides GUI (interactive) and command-line (batch) mode