124-java-secure-coding - Claude MCP Skill

# Java Secure coding guidelines

Identify and apply Java secure coding practices to reduce vulnerabilities, protect sensitive data, and harden application behaviour against common attack vectors.

**What is covered in this Skill?**

- Input validation: type, length, format, and range checks
- SQL/OS/LDAP injection defence via `PreparedStatement` and parameterized APIs
- Attack surface minimisation: least-privilege permissions, removal of unused features
- Strong cryptography: BCrypt/Argon2 for passwords, AES-GCM for encryption, digital signatures; avoid deprecated ciphers (MD5, SHA-1, DES)
- Secure exception handling: log diagnostic details internally, expose only generic messages to clients
- Secrets management: load credentials from environment variables or secret managers — never hardcoded
- Safe deserialization: strict allow-lists, prefer explicit DTOs over native Java serialization
- Output encoding to prevent XSS in rendered content

**Scope:** The reference is organized by examples (good/bad code patterns) for each core area. Apply recommendations based on applicable examples.

## Constraints

Before applying any secure coding changes, ensure the project compiles. If compilation fails, stop immediately — do not proceed until resolved. After applying improvements, run full verification.

- **MANDATORY**: Run `./mvnw compile` or `mvn compile` before applying any changes
- **SAFETY**: If compilation fails, stop immediately — do not proceed until the project is in a valid state
- **VERIFY**: Run `./mvnw clean verify` or `mvn clean verify` after applying improvements
- **BEFORE APPLYING**: Read the reference for detailed good/bad examples, constraints, and safeguards for each secure coding pattern

## When to use this skill

- Review Java code for secure coding
- Find input validation risks in Java code
- Review Java code for injection vulnerabilities
- Improve secure error handling in Java services
- Harden Java code against common security flaws

## Workflow

1. **Compile project before secure-coding changes**

Run `./mvnw compile` or `mvn compile` and stop immediately if compilation fails.

2. **Read secure-coding reference and assess risks**

Read `references/124-java-secure-coding.md` and identify applicable vulnerabilities and hardening opportunities.

3. **Apply secure-coding improvements**

Implement selected protections for input validation, crypto, secrets, deserialization, and output encoding.

4. **Verify with full build**

Run `./mvnw clean verify` or `mvn clean verify` after applying improvements.

## Reference

For detailed guidance, examples, and constraints, see [references/124-java-secure-coding.md](references/124-java-secure-coding.md).