Secure Coding in Java
A code-first training that turns the OWASP risk catalogue into concrete Java practice. Developers leave able to spot, fix and prevent the vulnerability classes that actually hit JVM applications.
What your team can do after
Concrete, transferable skills — not a slideware tour.
Spot vulnerability classes in review
Recognize the common Java vulnerability classes in code review — before they ship, not after a scanner flags them.
Apply secure-by-default patterns
Build in the fix instead of bolting one on afterward — validation, encoding and access control as defaults, not afterthoughts.
Handle secrets correctly
Password hashing (Argon2id/PBKDF2), key and secret handling — and just as important, know what not to build yourself.
Triage supply-chain risk
Read an SBOM and triage a known-vulnerability alert — reproducible builds and dependency hygiene, not guesswork.
Threat-model before writing code
Threat-model a feature before implementation — risk becomes a design input, not a post-hoc finding.
Agenda
Six modules, each ending in a hands-on lab on deliberately vulnerable code — find it, exploit it, fix it.
- Input & output
Validation, encoding, the injection family (SQL, command, path, template).
Lab: exploit & fix an injectable endpoint. - Authn & authz
Sessions, tokens, broken access control — and how jSentinel models it.
Lab: break and repair an access-control check. - Crypto & secrets
Password hashing (Argon2id/PBKDF2), key & secret handling.
Lab: fix a weak hashing + secret-in-code setup. - Deserialization & parsing
Unsafe deserialization, XXE, SSRF.
Lab: trigger and close an XXE/SSRF hole. - Dependencies & supply chain
SBOMs, known-vuln scanning, reproducible builds.
Lab: read an SBOM, triage a CVE. - Designing for security
Threat modeling, secure defaults, defense in depth.
Lab: threat-model a sample feature.
Who it's for
Java developers, tech leads and reviewers building web, REST or backend systems — anyone who ships JVM code and owns what happens when it's attacked.
Prerequisite: solid everyday Java; no security background required.
Logistics
📋 Course details
- Formats
- On-site · live-online · on-demand (in preparation)
- Duration
- Typically 1–2 days — depth and agenda tailored to your team
- Languages
- English or German
- Group size
- Private team cohorts or individual seats on scheduled dates
- Trainer
- Sven Ruppert, author of jSentinel — long-time Java developer and speaker