jvm
Safeguard articles tagged "jvm" — guides, analysis, and best practices for software supply chain and application security.
11 articles
Four Ways a Java Agent Instruments Nothing and Tells You It Worked
Class loader boundaries, a class literal that cannot resolve, advice read as a resource, and a re-entrancy guard that sticks. All four produce an agent that attaches cleanly and finds nothing.
Implementing TLS in Java applications: keystores, trust managers, and protocol pinning done right
One overridden checkServerTrusted() method disables certificate validation for an entire Java app — and it still ships to production more often than most teams admit.
Java SecurityManager is gone: a practical migration guide
JEP 411 deprecated the Security Manager in JDK 17; JEP 486 disabled it outright in JDK 24, released March 18, 2025. Here's how to migrate before it's removed for good.
Bytecode vs. source analysis: static analysis techniques for Java and Kotlin
SpotBugs scans compiled .class files for 400+ bug patterns; Semgrep parses source directly. Neither alone would have caught CVE-2015-7501 fast enough.
Is Java Safe? A Realistic Look at Java Security in 2025
Is Java safe? The language has strong built-in protections, but real Java risk lives in dependencies, deserialization, and configuration. Here is the honest picture.
Running Java in Docker: A Secure Dockerfile Walkthrough
A Java Docker container done right: multi-stage builds, a JRE not a full JDK, non-root users, JVM container-awareness, and a base image that does not ship the world.
The Java Cheat Sheet Developers Actually Need for Secure Code
Most Java cheat sheets stop at syntax. This one is the security-focused reference: the APIs, patterns, and one-liners that keep injection, deserialization, and crypto bugs out of your code.
Uncaught Exception in Java: A Security Guide
An uncaught exception in Java is more than a crash - it leaks stack traces, kills threads, and opens denial-of-service paths. Here is how to handle it safely.
Maven Release Plugin Hardening
The Maven Release Plugin is the oldest piece of release automation most Java shops still run. A look at the hardening steps it usually needs.
Gradle Version Catalogs Security
Gradle version catalogs centralise dependency versions in one file. The security payoff is concrete: auditability, uniform enforcement, and a single PR gate.
Reachability Analysis for Java: A 2026 Deep Dive
Java reachability under classpath reality: reflection, Spring autowiring, shaded JARs, Log4Shell, and what modern tools actually resolve versus over-approximate.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.