java-bytecode-auditor — JAR/.class security scanner (SARIF + SBOM)

Scans Java bytecode for risky stuff: Runtime.exec, ProcessBuilder, URLClassLoader, unsafe deserialization, and weak TLS patterns. Outputs SARIF v2.1.0 and a lightweight CycloneDX SBOM.

Build

./gradlew build    # or: gradle build

Run

# scan a jar and write sarif + sbom
java -jar build/libs/java-bytecode-auditor-all.jar scan target.jar --json out.sarif --sbom sbom.json --fail-on HIGH

# scan a directory (recursively)
java -jar build/libs/java-bytecode-auditor-all.jar scan path/to/classes --recursive

The tool is read‑only; it does static bytecode inspection with ASM. Minimal, fast, CI‑friendly.