Security Audit
This is a solid reference checklist for Java security audits that covers the OWASP Top 10 with practical code examples across Spring, Quarkus, Jakarta EE, and plain Java. It shows you the right way to do parameterized queries, input validation with Bean Validation annotations, XSS prevention with output encoding, and proper password hashing. The side-by-side good/bad examples make it easy to spot vulnerabilities during code review. Use this before production releases or when someone asks about security issues. The cross-framework approach is helpful since the validation and JDBC patterns work everywhere, though some features like CSRF configuration are framework specific.
- skills.sh installs
- 347
- GitHub stars
- 771
- last updated
- Feb 8, 2026
Install
$ npx -y skills add decebals/claude-code-java --skill security-audit --agent claude-codeInstalls into .claude/skills of the current project.
Files
Security Audit Skill
Security checklist for Java applications based on OWASP Top 10 and secure coding practices.
When to Use
- Security code review
- Before production releases
- User asks about "security", "vulnerability", "OWASP"
- Reviewing authentication/authorization code
- Checking for injection vulnerabilities
OWASP Top 10 Quick Reference
| # | Risk | Java Mitigation |
|---|---|---|
| A01 | Broken Access Control | Role-based checks, deny by default |
| A02 | Cryptographic Failures | Use strong algorithms, no hardcoded secrets |
| A03 | Injection | Parameterized queries, input validation |
| A04 | Insecure Design | Threat modeling, secure defaults |
| A05 | Security Misconfiguration | Disable debug, secure headers |
| A06 | Vulnerable Components | Dependency scanning, updates |
| A07 | Authentication Failures | Strong passwords, MFA, session management |
| A08 | Data Integrity Failures | Verify signatures, secure deserialization |
| A09 | Logging Failures | Log security events, no sensitive data |
| A10 | SSRF | Validate URLs, allowlist domains |
Input Validation (All Frameworks)
Bean Validation (JSR 380)
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/decebals/claude-code-java
- Categories
- Security, Java & JVM
- License
- MIT
- First seen
- Jun 11, 2026
More from decebals/claude-code-java
All 18- Performance Smell Detection341
- Test Quality336
- Api Contract Review315
- Maven Dependency Audit308
- Logging Patterns300
- Jpa Patterns297
- Changelog Generator251
- Git Commit249
- Issue Triage240
- Java Code Review1.1K
- Clean Code427
- Concurrency Review384
- Solid Principles384
- Architecture Review374
- Design Patterns372
- Spring Boot Patterns358
- Java Migration357
Recommended
More Security1
api-security-hardenerpatricio0312rev/skillsHardens API security with rate limiting, input validation, authentication, and protection against common attacks. Use when users request "API security", "secure284skills.sh installs
api-security-hardenerpatricio0312rev/skillsHardens API security with rate limiting, input validation, authentication, and protection against common attacks. Use when users request "API security", "secure284skills.sh installs2
security-expertpersonamanagmentlayer/pclExpert-level application security, OWASP Top 10, penetration testing, and security best practices228skills.sh installs
security-expertpersonamanagmentlayer/pclExpert-level application security, OWASP Top 10, penetration testing, and security best practices228skills.sh installs3
security-testing-verificationharperaa/secure-claude-skillsTest security features and verify implementation before deployment. Use this skill when you need to test CSRF protection, rate limiting, input validation, verif198skills.sh installs
security-testing-verificationharperaa/secure-claude-skillsTest security features and verify implementation before deployment. Use this skill when you need to test CSRF protection, rate limiting, input validation, verif198skills.sh installs4input-validation-xss-preventionharperaa/secure-claude-skillsValidate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input197skills.sh installs
input-validation-xss-preventionharperaa/secure-claude-skillsValidate and sanitize user input to prevent XSS, injection attacks, and ensure data quality. Use this skill when you need to validate forms, sanitize user input197skills.sh installs5
n8n-security-testingproffesor-for-testing/agentic-qeCredential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n 172skills.sh installs
n8n-security-testingproffesor-for-testing/agentic-qeCredential exposure detection, OAuth flow validation, API key management testing, and data sanitization verification for n8n workflows. Use when validating n8n 172skills.sh installs6
security-auditaakash-dhar/claude-skillsScans code for security vulnerabilities including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when t165skills.sh installs
security-auditaakash-dhar/claude-skillsScans code for security vulnerabilities including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when t165skills.sh installs