java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
138 articles
Spring Boot Logging Best Practices That Keep Secrets Out of Your Logs
Spring Boot logging best practices focused on security: structured logs, keeping secrets and PII out, safe log levels, and avoiding the mistakes that turned Log4Shell into a catastrophe.
Java URL Encode: How to Encode URLs Safely Without Introducing Bugs
The Java URL encode API is easy to reach for and easy to misuse. Here is when to use URLEncoder, when to use URI, and how the wrong choice becomes an injection risk.
spring-data-commons: A Security Guide
spring-data-commons underpins Spring Data's repository model, and one of its most infamous flaws - CVE-2018-1273 - turned property binding into remote code execution. Here is what to know.
Where Is Java Installed? Finding Your JDK (Including Homebrew)
Where is Java on your machine? Between system installs, Homebrew, and version managers you can easily run a JDK you didn't mean to. Here is how to find every one — and why the answer is a security question.
log4j Remediation: How to Fully Patch Log4Shell
A practical log4j remediation walkthrough: which versions actually fix Log4Shell, how to find the library transitively, and what to do when you cannot upgrade yet.
Code Review Best Practices for Java: A Security-First Guide
Security-focused code review best practices for Java teams: what to look for, how to structure reviews, and the recurring bug classes that slip past compilers.
CVE-2022-31159: Path Traversal in the AWS SDK for Java
CVE-2022-31159 is a partial path traversal flaw in the AWS SDK for Java v1's S3 TransferManager. Here is who it affects, how it works, and how to fix it.
How to Fix the SnakeYAML Vulnerability (CVE-2022-1471)
The SnakeYAML vulnerability fix comes down to one move: get off the 1.x line and onto 2.x, where the parser stops trusting arbitrary Java types by default.
Java LTS Versions Explained: What They Mean for Security
A Java LTS release gets years of patches instead of six months, which makes your choice of version a security decision as much as a feature one.
org.json Maven: A Security Guide
The org.json Maven dependency ships a small JSON parser with a history of denial-of-service bugs. Here is how to pin a safe version and catch it transitively.
The Java Developer Kit Explained: Security Risks and How to Harden Your JDK
The Java Developer Kit is more than a compiler and runtime. Here is how to treat the JDK as part of your attack surface and keep it patched.
org.owasp.esapi: What the OWASP ESAPI Library Is and How to Use It Safely
org.owasp.esapi is the Maven coordinate for OWASP ESAPI, a Java security control library. Here is what it does, where it still helps, and the CVEs to watch.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.