java-security-audit

Use parameterized queries with named parameters in JPQL, the Criteria API, or PreparedStatement for JDBC. Never concatenate user input into query strings, as string concatenation in JPQL or native SQL is the primary injection vector.

Use BCrypt with a strength factor of 12 or Argon2 for new projects, both available via Spring Security's PasswordEncoder. Never use MD5, SHA1, or unsalted SHA-256 for password storage since they are vulnerable to rainbow table and brute-force attacks.

Yes, the checklist covers Spring Security configuration, Quarkus CSRF properties, Jakarta EE, and framework-agnostic patterns like Bean Validation (JSR 380). Core mitigations such as parameterized queries and output encoding apply to all Java frameworks.

Run the OWASP Dependency Check Maven plugin with mvn dependency-check:check, which generates an HTML report of CVEs in your dependencies. Configure failBuildOnCVSS to fail builds on high-severity findings and keep dependencies updated with mvn versions:display-dependency-updates.

ObjectInputStream.readObject on untrusted data allows remote code execution through gadget chains in the classpath. Use JSON with Jackson instead, disable default typing, and avoid polymorphic deserialization of untrusted input.