Security on JAVAPRO International

The 5 Knights of the MCP Apocalypse

Wed, 01 Jul 2026 07:00:01 +0000

Let’s talk about that new MCP (Model Context Protocol) Server your team is using to connect to your real data services. It’s awesome, right? It’s the “magic box” that gives your AI Agent access to the real world—live databases, internal APIs, and all your tools.

But here’s the catch: you don’t own the code.

It’s a vendor product, an open-source project, or another team’s platform. You can’t just change its code when you find a security hole, unless you have the code and recompile it and deploy it.

The Whispering JAR: Java Security Lessons Hidden in a Fantasy Tale

Thu, 23 Apr 2026 07:00:01 +0000

It’s December 29th, 1865, and a woman is walking down Salzstraße in the city of Freiburg in the Duchy of Baden. She has a green cloak on, and her face is not very visible in the thick fog. She enters a small alley and knocks. A man walks to the door and asks, “What’s in the jar?” The woman replies, “Java beans.”

Woman with a hood and red hair and a plate armor walking in the streets of Freiburg in 1865

Modernizing Production Containers to Resist the Constant CVE Flow

Tue, 14 Apr 2026 07:00:03 +0000

Common Vulnerabilities and Exposures or CVEs is a catalog of publicly disclosed software security flaws that attackers can use to gain unauthorized access.

With 40,003 CVEs recorded in 2024, denoting a 39% increase as compared to 2023, container vulnerabilities are no longer a minor cleanup task. It is a river that floods Kubernetes clusters, drowning the teams in operational burden while real exposures slip through.

Chasing every single CVE is a road to nowhere as new vulnerabilities are discovered constantly. The solution is to build a centralized vulnerability management system that will serve as a dam resisting the CVE flood and enable controlled CVE identification and remediation.

Zero Migration Java - Staying Current Without Breaking Your App

Fri, 10 Apr 2026 07:00:01 +0000

Keeping enterprise Java applications secure and up-to-date is critical but traditional runtime upgrades often come with painful migrations, broken dependencies, and retesting cycles. What if developers could upgrade their runtime without touching their code? In this article, we explore the concept of zero migration — a runtime model that allows Java applications to stay current with the latest pat

curl | bash | hacked: the unseen dangers in your dev lifecycle

Wed, 25 Mar 2026 07:00:02 +0000

There’s a line of shell that looks harmless, even helpful:

CODE

curl <XXX> | bash

It promises speed. Convenience. “Just install the thing and get on with your day.”

That promise is exactly why attackers love it.

That one-liner doesn’t merely install a tool. It hands execution control to whatever sits on the other end of a network request, runs with your permissions on your machine, and within your environment. There is no sandbox. No review step. No guardrails.

10 Docker Commandos: Docker Commands to Hunt the Predator

Thu, 19 Mar 2026 07:00:01 +0000

Whose day is it on Tuesday?

I mean, Wednesday is Odin’s day, Thursday is Thor’s day, and Friday is Frigg’s day, or Freya’s, depending on who you ask. But what about Tuesday? Who is the god of Tuesday?

Odin = Wednesday Thor = Thursday Frigg = Friday

It’s Týr, the god of war and justice. In Norse mythology, Týr is known for his bravery and sacrifice, as he lost his hand to the monstrous wolf Fenrir.

7 Habits of Highly Effective AI Java Coding

Thu, 12 Mar 2026 07:00:01 +0000

From AI User to AI Pro

Let’s be real, AI coding tools are everywhere now. They’re no longer some shiny new toy—they’re a part of our daily grind as developers, just like our morning coffee.

For us Java devs, whether we’re wrestling with a giant legacy app or juggling a bunch of microservices, these tools look like a huge win for getting stuff done faster.

But here’s the catch: just coding faster isn’t the whole story. If you’re not careful, it can actually lead to bigger problems down the road.

PEM files as an alternative to keystores

Tue, 17 Feb 2026 07:00:02 +0000

JDK 25 introduces the preview of JEP 470 - PEM encodings of cryptographic objects. The JEP introduces new classes and methods to handle keys and certificates stored in so-called PEM files. It was possible to load / store files in this format before this JEP, but the handling was far from easy. This JEP simplifies the handling of and allows programmers to easily work with the widely used PEM file format in their applications.

The Myth of Stability: Java's Software Supply Chain After Log4Shell

Thu, 08 Jan 2026 07:00:02 +0000

For as long as most Java developers can remember, we’ve lived inside a comforting story about our ecosystem. It’s the idea that Maven Central, the Jakarta stack, the Spring universe, the vast Apache landscape, and all the independent libraries quietly carrying enterprise workloads together form a coherent, self-maintaining, self-healing whole.

A world where problems are fixed upstream, where maintainers have time, where the dependencies we pull down are being actively watched by someone who knows exactly what they’re doing. It’s a lovely idea. It’s also never been completely real.

Security in the Age of Java 25: New Language Tools for Safer Code

Tue, 30 Dec 2025 07:00:03 +0000

Security is more than just encryption - it’s also about how you write code. There are several Java security features that can help prevent logic bugs, misuse of types, and unexpected state mutations. Learn how sealed classes, pattern matching, and records can reinforce domain modeling, reduce null checks, and prevent injection-prone scenarios.

Introduction: Why Java security features Matters More Than Ever

Application security has never been a static field. Over the past two decades, the Java platform has evolved not just as a runtime for enterprise applications but as a trusted foundation for industries ranging from finance and healthcare to government systems. Security breaches, once attributed primarily to poor encryption or missing authentication, now more often stem from subtler flaws: unchecked input, leaky abstractions, and poorly modeled domain logic.

Mastering API Security in Java: OWASP Best Practices

Wed, 12 Nov 2025 07:00:01 +0000

Introduction

Building secure applications is a top priority for any developer, and when it comes to APIs, security becomes even more crucial. APIs expose sensitive data and functionality, making them attractive targets for attackers. The OWASP API Security Top 10 provides a list of the most critical security risks to be aware of.

You will be mastering the API Security in Java by mitigating these risks, offering practical Java code examples to illustrate both bad practices and best practices for each vulnerability.

The Shai-Hulud NPM Worm: When Supply Chains Bite Back

Thu, 02 Oct 2025 07:00:01 +0000

Let’s be clear: Shai-Hulud wasn’t just another npm compromise. For the first time, a self-propagating worm ripped through the JavaScript supply chain. We’ve seen worms before, but this one changed the game. It hijacked developers’ credentials and CI/CD pipelines, transforming them into its attack vector.

At KCDC and JavaZone, I warned about the dangers of curl | bash | hacked. Unfortunately, what once looked like a theory (or an occasional exploit) has now evolved into something far more dangerous.

Exploring XDEV SSE: Enhancing Spring Security for Modern Applications

Fri, 25 Jul 2025 07:00:01 +0000

In the ever-evolving world of web application security, keeping up with best practices is crucial. XDEV’s Extras for Spring Security (XDEV SSE) addresses common challenges developers face when securing distributed systems. This open-source enhancement for Spring Security offers a suite of features to simplify secure application development.

Overview

The extension provides several modules that make managing security in Spring-based applications more straightforward. Its main focus lies on improving OAuth2/OIDC management, session handling, and login persistence, while also simplifying integration with modern frontends. One key benefit is more efficient handling of user sessions through automatic access validation—even after server restarts, security is maintained across all applications.

From Breaches to Blackouts: The Human Consequences of Software Supply Chain Attacks

Wed, 23 Jul 2025 07:00:01 +0000

Have you ever considered the impact of Cybercrime? How do your choices in terms of applying good security practices matter? Given that the current estimate for the annual bill worldwide is 9 Trillion US Dollars, there is obviously a significant financial reward for the bad guys, but have you ever wondered how that breaks down or if there’s more to their motivations and actions than just money?

This article will explore the financial element and broader human implications.

How to Containerize a Java Application Securely

Thu, 03 Jul 2025 07:00:01 +0000

TL;DR

Containerization or Dockerization is the process of packaging an application and its dependencies into a Docker image.
It’s beneficial to containerize your Java application as it provides a consistent environment for development, testing, and deployment.
Java is a compiled language, so your Docker image will only contain the compiled Java bytecode and the Java runtime environment.
Supply-chain security is the process of checking the dependencies in your application for vulnerabilities.
SBOM (Software Bill of Materials) is a list of all the dependencies in your application.
It’s a good practice to generate an SBOM when building your Docker image and push it to a registry for later reference.

Technical Requirements

In this article, we will use the following tools:

Java in Critical Operations: How Custom Development Ensures Control and Secures Mission-Critical Systems

Mon, 02 Jun 2025 08:15:19 +0000

When IT fails, no one notices—until everyone does.
Whether in hospitals, energy grids, or airports, stable operation of digital systems in safety-critical environments is not an option, but a strict requirement. This is where infrastructure must prove its resilience, scalability, and independence in the face of real-world crises.

A prime example is Fraport AG, operator of one of Europe’s largest aviation hubs. When baggage goes missing or safety-critical information is delayed, it’s not just individual passengers’ vacations that are at risk—the operational stability of the entire airport is on the line. Behind the scenes of such a hub runs an extremely complex digital infrastructure that must operate reliably 24/7, despite increasing demands, ageing legacy systems, and tightening security regulations.

A Passwordless Future: Passkeys for Developers

Fri, 30 May 2025 07:00:01 +0000

Passwords have been around for thousands of years and we were all happily sharing our Netflix passwords. They are probably not going anywhere but they are not the best way to secure our digital lives. They are a hassle for users and a security risk for applications. The future of secure authentication is passwordless and passkeys are leading the way.

According to Verizon’s 2024 Data Breach Investigations Report, stolen credentials and phishing account for over 65% of all data breaches.

Top Security Flaws hiding in your code right now - and how to fix them

Tue, 29 Apr 2025 07:00:07 +0000

In 2019, a significant breach in Fortnite, the popular game, reportedly exposed millions of players to malware risk. The incident underscored the importance of securing SQL databases properly.

But this is not an isolated issue.

Multiple attacks involving SQL injection have occurred, like the one Tesla experienced in 2018. In that case, another SQL injection attack affected Tesla’s Kubernetes console, resulting in financial losses due to unauthorized cryptocurrency mining activities.

But this is not only about SQL Injection.

Securing the Future of AI: Authorization for Java RAG Systems using LangChain4j and OpenFGA

Mon, 14 Apr 2025 07:00:02 +0000

In this post, we explore how to build a robust Java-based RAG system by integrating LangChain4j with OpenFGA for fine-grained, relationship-based access control. Learn how to tackle the unique security challenges of RAG applications—from dynamic context and complex document relationships to real-time authorization checks—and follow step-by-step examples that show you how to implement a secure syst

Move Fast, Break Laws: AI, Open Source and Devs (Part 4)

Thu, 10 Apr 2025 07:00:02 +0000

The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As our reliance on software and AI grows, so does our vulnerability to cybercrime, which is now a multi-trillion-dollar problem. This has caught the attention of regulators worldwide.

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 3)

Tue, 08 Apr 2025 07:00:01 +0000

Background

Part 1 covered the background, what a software supply chain is and thoughts on AI and open source.

Part 2 explored how governments are working to create legislation and what the current status is.

The quick check for your software - the Software Coma Scale (SCS)

Mon, 07 Apr 2025 11:22:49 +0000

Do you know this situation: You have are sitting on your desk when your boss asks you to “just have a look at an old software-system” at its current status? Since he doesn’t know much about your job (IT), you have to use a system that

a) he understands and

b) allows you to make an informed assessment relatively quickly.

Or a customer asks whether you could change this or that thing in a system you don’t know - or even take over the maintenance for it. And just like your boss, he is not an IT specialist!

Move Fast, Break Laws: AI, Open Source and Devs (Part 2)

Thu, 03 Apr 2025 09:56:07 +0000

This article explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they get to grips with 2025 - the year of software legislation

Move Fast, Break Laws: AI, Open Source and Devs (Part 1)

Tue, 01 Apr 2025 11:34:21 +0000

This article series explains the various regulatory efforts in play and summarises actions that developers and executives should consider as they prepare for 2025, the year of software legislation.

My Top 10 Principles for getting the best from AI (for developers)

Mon, 02 Dec 2024 11:56:54 +0000

AI tools for developers: principles, insights, and the importance of clean code.

Every day, I encounter a new AI tool, whether a new capability is added to an existing tool or an entirely new offering. I actively use several AI tools, including ChatGPT, Grammarly, and Amazon Q Developer, each serving different purposes. I pay for pro access to ChatGPT and Grammarly, though I sometimes consider switching to Claude.ai, which occasionally proves invaluable. s a view of AI tools for developers: my principles, insights and ultimately the realisation that development practises such as clean code is more essential than ever

The AI Mona Lisa Challenge: Precision and Security Adjustments for Your CI/CD Pipeline

Thu, 21 Nov 2024 12:22:47 +0000

“Mona Lisa, Mona Lisa, men have named you; you’re so like the lady with the mystic smile.”

Last time, I finished a set of articles about using AI coding tools. In the end, my conclusion was that the tools can help greatly but that right now, using them to generate whole programs was pushing the envelope. As helpers, as pseudo-pair-programmers, the tools can offer great value and make you more productive. However, it’s essential to understand that this process works because of the interaction between humans and AI. Without the steering and a continuous mix of rejection and acceptance, the AI can’t learn how to respond correctly.

Discovering the perfect Java Supply Chain Attack vector and how it got fixed

Tue, 19 Nov 2024 12:00:00 +0000

You may have heard about the changes to annotation processing that have been done in Java 23. This post will cover the underlying topic, how I learned about it, and how it got fixed.

Background

To understand annotation processing and why it is even there, we first need to hop into our DeLorean and go back to the year ~~1955~~ 2005. So back then there were no build tools like Maven or Gradle, which we have nowadays. Java was still developed by Sun Microsystems and the newest version was 5. Java annotations were introduced with Java 5 but an API for processing them at build-time did not exist, so JSR 269 was born. The general idea seems to have been to allow the generation of (boilerplate) code and similar operations. Examples that use the concept nowadays are probably Lombok or Dagger (for the Android world) but these are usually run with dedicated plugins. I found an old video of a presentation about this topic - you may want to check it out for additional background information. JSR 269 was ultimately implemented and shipped in 2006 with Java 6. Most details of it were likely ignored over the years as better build tools such as Maven or Gradle gradually gained popularity.