Spring Sentinel is an open-source static analysis tool for Spring Boot projects. It helps developers catch performance bottlenecks, security risks, and architectural smells early in the pipeline. It supports Maven, Gradle, and SpotBugs, and generates HTML, JSON, SARIF, and CI-friendly comment reports.

Spring Sentinel isn't meant to replace tools like SonarQube—it's designed to complement them. While SonarQube is a general-purpose static analysis platform, Spring Sentinel is specialized for Spring Boot. It understands common Spring patterns and detects framework-specific issues such as JPA pitfalls, transactional anti-patterns, Spring Security misconfigurations, inefficient dependency injection, and other problems that generic analyzers often miss. It's also designed to fit naturally into modern CI/CD pipelines. You can run it during your Maven or Gradle build, fail the build when critical issues are found, and generate HTML, JSON, or SARIF reports for GitHub Actions and other CI systems. The project is completely open source, and I'm looking for feedback from Spring developers:

A SARIF output is great for GitHub code scanning, but it would be even more useful if the HTML report linked each finding directly to the offending line in the repository or PR view. Right now I have to dig through the JSON to find the exact file and line, then jump to it manually.

The SARIF output support is genuinely thoughtful, since most tools still ignore that format. Nice to see a focus on playing well with existing CI pipelines rather than locking people in.

Spring Sentinel

Framework static analysis for Spring Boot

Framework static analysis for Spring Boot