--- title: The Hidden Security Hazards in Your Java Stack by Brian... description: A conference talk transcript covering common Java security vulnerabilities with live demos. Topics include XSS from unsanitized input, SQL injection via... canonical: https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Hidden Security Hazards in Your Java Stack by Brian Vermeer | daily.dev og:description: A conference talk transcript covering common Java security vulnerabilities with live demos. Topics include XSS from unsanitized input, SQL injection via... og:url: https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx og:image: https://api.daily.dev/og/posts/uiXjRrvgX.png og:image:alt: The Hidden Security Hazards in Your Java Stack by Brian Vermeer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Hidden Security Hazards in Your Java Stack by Brian Vermeer **[Devoxx](https://daily.dev/sources/devoxx)** · 48 min read · 0 upvotes · 0 comments ## Summary A conference talk transcript covering common Java security vulnerabilities with live demos. Topics include XSS from unsanitized input, SQL injection via AI-generated code (GitHub Copilot), path traversal in file uploads, XXE (XML External Entity) injection in SAX parsers, sensitive data exposure through entity serialization, Log4Shell exploitation via JNDI lookups, and vulnerable Docker base images. The speaker demonstrates how AI coding assistants like Copilot and Windsurf can generate insecure code by default, and advocates for integrating security scanning tools (like Snyk) into the development workflow. Practical advice covers using prepared statements with JPA/Hibernate, disabling XML external entities, creating DTOs instead of exposing entities, keeping dependencies and container base images updated, and a bottom-up approach to legacy security remediation: containers first, then frameworks, then code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Foojay Podcast \#95: Is Your Java App Actually Secure, Or Does It Just Look That Way?](https://daily.dev/posts/foojay-podcast-95-is-your-java-app-actually-secure-or-does-it-just-look-that-way--b0bfzimhn) · Foojay.io · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#sql](https://daily.dev/tags/sql), [#spring-boot](https://daily.dev/tags/spring-boot), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Hidden Security Hazards in Your Java Stack by Brian Vermeer","url":"https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx"},"datePublished":"2026-04-01T08:25:13.605Z","dateModified":"2026-04-01T08:25:41.782Z","description":"A conference talk transcript covering common Java security vulnerabilities with live demos. Topics include XSS from unsanitized input, SQL injection via...","image":"https://i.ytimg.com/vi/LJ_GRwPj11E/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/LJ_GRwPj11E/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Devoxx","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Devoxx","logo":"https://media.daily.dev/image/upload/s--6vG797wn--/f_auto,q_auto/v1773648800/logos/devoxx?_a=BAMAMiiu0","url":"https://daily.dev/sources/devoxx"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-hidden-security-hazards-in-your-java-stack-by-brian-vermeer-uixjrrvgx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,sql,spring-boot,appsec","timeRequired":"PT48M","video":{"@type":"VideoObject","name":"The Hidden Security Hazards in Your Java Stack by Brian Vermeer","description":"A conference talk transcript covering common Java security vulnerabilities with live demos. Topics include XSS from unsanitized input, SQL injection via...","thumbnailUrl":"https://i.ytimg.com/vi/LJ_GRwPj11E/sddefault.jpg","uploadDate":"2026-04-01T08:25:13.605Z","duration":"PT48M","url":"https://api.daily.dev/r/uiXjRrvgX","embedUrl":"https://www.youtube.com/embed/LJ_GRwPj11E"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Devoxx","item":"https://daily.dev/sources/devoxx"},{"@type":"ListItem","position":3,"name":"The Hidden Security Hazards in Your Java Stack by Brian Vermeer"}]} ```