--- title: Java Secure Coding Guidelines | daily.dev description: A talk from Oracle's Java vulnerability team lead, Andrew Gross, walks through the Java Secure Coding Guidelines document and common vulnerability patterns. It... canonical: https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Java Secure Coding Guidelines | daily.dev og:description: A talk from Oracle's Java vulnerability team lead, Andrew Gross, walks through the Java Secure Coding Guidelines document and common vulnerability patterns. It... og:url: https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk og:image: https://api.daily.dev/og/posts/3WhtmkRZK.png og:image:alt: Java Secure Coding Guidelines og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Java Secure Coding Guidelines **[Java \(Official Oracle\)](https://daily.dev/sources/java-oracle)** · 34 min read · 0 upvotes · 0 comments ## Summary A talk from Oracle's Java vulnerability team lead, Andrew Gross, walks through the Java Secure Coding Guidelines document and common vulnerability patterns. It covers Log4j, noting Sonatype tracked over 40 million downloads of vulnerable versions in 2025, four years after the 2021 flaw. It covers an XZ backdoor attempt targeting SSHD, built up over two years by a person who pressured their way into co-maintainer status. It also flags a newer risk: LLMs hallucinating package names that attackers register and poison. The guidelines cover injection, input validation, and serialization, including JDK filters that limit deserialized object graph size, depth, and references. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many downloads of vulnerable Log4j versions were there years after the original vulnerability was disclosed? Sonatype tracked over 40 million downloads of vulnerable Log4j versions in 2025, four years after the original Log4j security flaw was disclosed in 2021. This shows that many projects, likely including personal and smaller ones, still pull in the vulnerable versions long after a fix became available. _Anyone auditing dependencies for lingering Log4j risk can track advisories like this through daily.dev._ ### What security risk does AI code generation introduce with package names? AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers register those exact names on package repositories, loading them with malicious code. When a developer's AI-suggested import matches a hallucinated name, installing it pulls in an attacker-controlled package disguised as the intended dependency, similar to classic domain typosquatting. _Developers vetting AI-suggested dependencies can follow emerging supply-chain threats like this via daily.dev._ ### How did the XZ Utils backdoor get introduced into the project? An attacker spent about two years building trust in the XZ Utils open source community by submitting legitimate change sets, eventually pressuring the overworked part-time maintainer into making them a co-maintainer. Once granted that access, the attacker disabled tests and security checks and inserted encrypted payloads intended to create a backdoor in SSHD, which was discovered before widespread exploitation. _Teams assessing open source maintainer risk can track incidents like the XZ backdoor on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Java Secure Coding Guidelines","url":"https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk"},"datePublished":"2026-10-27T11:24:42.521Z","dateModified":"2026-10-27T11:25:14.079Z","description":"A talk from Oracle's Java vulnerability team lead, Andrew Gross, walks through the Java Secure Coding Guidelines document and common vulnerability patterns. It...","image":"https://i.ytimg.com/vi/-AjYEYmRLmQ/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/-AjYEYmRLmQ/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Java (Official Oracle)","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Java (Official Oracle)","logo":"https://media.daily.dev/image/upload/s--SM9hIYUY--/f_auto,q_auto/v1773648791/logos/java-oracle?_a=BAMAMiiu0","url":"https://daily.dev/sources/java-oracle"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,appsec","timeRequired":"PT34M","video":{"@type":"VideoObject","name":"Java Secure Coding Guidelines","description":"A talk from Oracle's Java vulnerability team lead, Andrew Gross, walks through the Java Secure Coding Guidelines document and common vulnerability patterns. It...","thumbnailUrl":"https://i.ytimg.com/vi/-AjYEYmRLmQ/sddefault.jpg","uploadDate":"2026-10-27T11:24:42.521Z","duration":"PT34M","url":"https://api.daily.dev/r/3WhtmkRZK","embedUrl":"https://www.youtube.com/embed/-AjYEYmRLmQ"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Java (Official Oracle)","item":"https://daily.dev/sources/java-oracle"},{"@type":"ListItem","position":3,"name":"Java Secure Coding Guidelines"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/java-secure-coding-guidelines-3whtmkrzk#faq","mainEntity":[{"@type":"Question","name":"How many downloads of vulnerable Log4j versions were there years after the original vulnerability was disclosed?","acceptedAnswer":{"@type":"Answer","text":"Sonatype tracked over 40 million downloads of vulnerable Log4j versions in 2025, four years after the original Log4j security flaw was disclosed in 2021. This shows that many projects, likely including personal and smaller ones, still pull in the vulnerable versions long after a fix became available. Anyone auditing dependencies for lingering Log4j risk can track advisories like this through daily.dev."}},{"@type":"Question","name":"What security risk does AI code generation introduce with package names?","acceptedAnswer":{"@type":"Answer","text":"AI coding assistants sometimes hallucinate package names that don't actually exist, and attackers register those exact names on package repositories, loading them with malicious code. When a developer's AI-suggested import matches a hallucinated name, installing it pulls in an attacker-controlled package disguised as the intended dependency, similar to classic domain typosquatting. Developers vetting AI-suggested dependencies can follow emerging supply-chain threats like this via daily.dev."}},{"@type":"Question","name":"How did the XZ Utils backdoor get introduced into the project?","acceptedAnswer":{"@type":"Answer","text":"An attacker spent about two years building trust in the XZ Utils open source community by submitting legitimate change sets, eventually pressuring the overworked part-time maintainer into making them a co-maintainer. Once granted that access, the attacker disabled tests and security checks and inserted encrypted payloads intended to create a backdoor in SSHD, which was discovered before widespread exploitation. Teams assessing open source maintainer risk can track incidents like the XZ backdoor on daily.dev."}}]} ```