While taking a look at https://bugs.openjdk.org/browse/JMC-8150, I noticed that we don't run SpotBugs on /core. There are some comments in core files that mention specific changes to avoid flagging SpotBugs, but I'm guessing were from way back when JMC was being open sourced and files probably moved from /application into /core. If this is something that could be beneficial, we should take a look at adding it in. It could also apply to agent as well.