I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others were more focused on code quality tools. Am I missing something here or there are no open-source initiatives/projects/tools available for this purpose?
Codacy (an automated code review platform) has been deploying Scala security patterns.
There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can filter for security to check the other ones out (more will be coming out soon).
The way Codacy works is you log into the platform, point it to your git repository and it analyses each of your commits, letting you know whether you created/fixed any issues (be them coding style/performance/complexity/security/etc). There's also an on-premises version.
Codacy gives you the full flexibility to customize the rules you use and even create your own.
It's free for Open Source projects.
If there are common design patterns like php's
<?=$_GET['blah']?> then you could easily write some regular expressions to detect them with a grep based tool like
VisualCodeGrepper. For some deeper analysis however you would most likely need to write a token or AST parser and apply taint tracking. The wikipedia static analysis page may be a good starting point: https://en.wikipedia.org/wiki/Static_program_analysis