java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
Where Is Java Installed? Finding Your JDK (Including Homebrew)
Where is Java on your machine? Between system installs, Homebrew, and version managers you can easily run a JDK you didn't mean to. Here is how to find every one — and why the answer is a security question.
log4j Remediation: How to Fully Patch Log4Shell
A practical log4j remediation walkthrough: which versions actually fix Log4Shell, how to find the library transitively, and what to do when you cannot upgrade yet.
Code Review Best Practices for Java: A Security-First Guide
Security-focused code review best practices for Java teams: what to look for, how to structure reviews, and the recurring bug classes that slip past compilers.
How to Fix the SnakeYAML Vulnerability (CVE-2022-1471)
The SnakeYAML vulnerability fix comes down to one move: get off the 1.x line and onto 2.x, where the parser stops trusting arbitrary Java types by default.
CVE-2022-31159: Path Traversal in the AWS SDK for Java
CVE-2022-31159 is a partial path traversal flaw in the AWS SDK for Java v1's S3 TransferManager. Here is who it affects, how it works, and how to fix it.
Java LTS Versions Explained: What They Mean for Security
A Java LTS release gets years of patches instead of six months, which makes your choice of version a security decision as much as a feature one.
org.json Maven: A Security Guide
The org.json Maven dependency ships a small JSON parser with a history of denial-of-service bugs. Here is how to pin a safe version and catch it transitively.
org.owasp.esapi: What the OWASP ESAPI Library Is and How to Use It Safely
org.owasp.esapi is the Maven coordinate for OWASP ESAPI, a Java security control library. Here is what it does, where it still helps, and the CVEs to watch.
The Java Developer Kit Explained: Security Risks and How to Harden Your JDK
The Java Developer Kit is more than a compiler and runtime. Here is how to treat the JDK as part of your attack surface and keep it patched.
YAML Parsers in Java: SnakeYAML Deserialization Risks Explained
Choosing a YAML parser in Java means choosing a deserialization posture. How SnakeYAML's CVE-2022-1471 worked, what changed in 2.0, and how to parse YAML safely.
CVE-2020-25638: SQL Injection in Hibernate ORM Explained
CVE-2020-25638 is a SQL injection flaw in hibernate-core that surfaces when SQL comments are enabled and literals are used in JPA Criteria queries. Here is who is affected and how to remediate it.
XXE Fix in Java: How to Harden Every XML Parser
The XXE fix in Java is the same idea across every parser — turn off DOCTYPE and external entities before you feed it untrusted XML. Here are the exact settings for each JDK XML API.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.