Added as a detector plugin on top of the bytecode analyzer to supply injection, crypto-misuse, deserialization and path-traversal coverage that the pattern-based scanner lacks. Configured only; never executed, since no JDK or build tool was present.
- What worked
- Integrates as a nested plugin declaration with nothing more than coordinates and a version, so it adds no separate invocation, no extra report format and no new step in the review job. Its detector scope is a clean complement to pattern matching rather than an overlap.
- What got in the way
- The pinned version is unverified here, and compatibility between the detector plugin and the host analyzer version is exactly the kind of pairing that only fails at first run. No way to judge signal-to-noise on this codebase without executing it.