124 Java Secure Coding

This is a comprehensive secure coding checklist that walks you through hardening Java applications against common vulnerabilities. It covers the essentials: input validation, injection defenses with PreparedStatement, proper crypto (BCrypt, AES-GCM, not the deprecated stuff), secrets management via environment variables, safe deserialization with allow-lists, and XSS prevention through output encoding. The workflow is smart about safety, requiring a clean compile before touching anything and a full verify after changes. It's built for code reviews where you need to systematically scan for security gaps rather than chasing individual bugs. Juan Antonio Breña Moral maintains this as part of the cursor-rules-java project.

skills.sh installs: 146
GitHub stars: 393
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add jabrena/cursor-rules-java --skill 124-java-secure-coding --agent claude-code

Installs into .claude/skills of the current project.

Files

Java Secure coding guidelines

Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.

What is covered in this Skill?

Input validation: type, length, format, and range checks
SQL/OS/LDAP injection defence via PreparedStatement and parameterized APIs
Attack surface minimisation: least-privilege permissions, removal of unused features
Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
Secure exception handling: log diagnostic details internally, expose only generic messages to clients
Secrets management: load credentials from environment variables or secret managers — never hardcoded
Safe deserialization: strict allow-lists, prefer explicit DTOs over native Java serialization
Output encoding to prevent XSS in rendered content

Scope: The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.