Error Prone VS openvas-scanner

error-prone is good for some extra static analysis.

A special kind of validation is enforcing that record fields are not null. (Un)fortunately, records do not have any special behavior regarding nullability. You can use tools like NullAway or Error Prone to prevent null in your code in general, or you can add checks to your records:

I am all in favour to more third side libraries adding functionalities, like Lombok, Manifold and error prone. As well as smaller projects like this shameless plug and what appears in this list

If only Google didn't suck when it came to Java9+ support... https://github.com/google/error-prone/issues/2649

I haven't used it. I use Google's ErrorProne + Lombok to prevent NPEs in java.

Take a look at NullAway, a plugin for Error Prone.

For some of this stuff, there are compiler extensions that allow extra type checking to be added e.g. Google Error-Prone: https://github.com/google/error-prone with stuff like: https://errorprone.info/bugpattern/ReturnMissingNullable.

Doesn't help you with third party libraries, but across an org applying that rule (and others!) typically ensures some consistency.

How to build a static analysis plugin. Google has a framework for Java with a good tutorial.

OpenVAS - https://github.com/greenbone/openvas-scanner

OWASP Zap, OWASP Amass, OpenVAS Scanner

And OpenVAS and OpenSSH and OpenBSD and OpenNN and OpenAFS and on and on and on

We can create an automation pipeline to patch the server using Foreman or Red Hat Satellite and for scanning, we can use OpenVAS or Nessus to get the list of vulnerabilities.

OpenVAS

I don't recommend cheaping out on vuln scanning, but if you really can't get any money there's always OpenVAS. That will allow you to do credentialed scanning and track vulnerabilities in your environment. It's no real substitute for Tenable or similar, but it's better than nothing.