Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find in…
Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS.
This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws.
Part of Plinth Toolkit
Similar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Claude CodeNot declared
CursorNot declared
CodexNot declared
GitHub CopilotNot declared
WindsurfNot declared
Gemini CLINot declared
ClineNot declared
OpenCodeNot declared
Repository health
Stars437
LicenseLICENSE
Default branchmain
Open issues22
Status
Active
Skill metadata
Parsed from SKILL.md frontmatter.
Version0.18.0
LicenseApache-2.0
More metadata
author
Juan Antonio Breña Moral
version
0.18.0
Package contents
Files included with this skill beyond the listing page.
skill mdSKILL.md3,549 B
docsSUMMARY.md732 B
History
First seen on skills.sh
First recorded snapshot · 369 installs
SKILL.md
Java Secure coding guidelines
Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.
What is covered in this Skill?
Input validation: type, length, format, and range checks
SQL/OS/LDAP injection defence via PreparedStatement and parameterized APIs
Attack surface minimisation: least-privilege permissions, removal of unused features
Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
Secure exception handling: log diagnostic details internally, expose only generic messages to clients
Secrets management: load credentials from environment variables or secret managers — never hardcoded
Output encoding to prevent XSS in rendered content
Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.
Constraints
Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.
MANDATORY: Run ./mvnw compile or mvn compile before applying any changes
SAFETY: If compilation fails, stop immediately — do not proceed until the project is in a valid state
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
BEFORE APPLYING: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern
When to use this skill
Review Java code for secure coding
Find input validation risks in Java code
Review Java code for injection vulnerabilities
Improve secure error handling in Java services
Harden Java code against common security flaws
Workflow
Compile project before secure-coding changes
Run ./mvnw compile or mvn compile and stop immediately if compilation fails.
Read secure-coding reference and assess risks
Read references/124-java-secure-coding.md and identify applicable vulnerabilities and hardening opportunities.
Apply secure-coding improvements
Implement selected protections for input validation, crypto, secrets, deserialization, and output encoding.
Verify with full build
Run ./mvnw clean verify or mvn clean verify after applying improvements.
Reference
For detailed guidance, examples, and constraints, see [references/124-java-secure-coding.md](references/124-java-secure-coding.md).
