# Java application security review worksheet

Source: https://yenra.com/java/security/
Scope: a Java 25 application review; adapt controls to the deployed JDK and framework.
Use a staging environment and synthetic data for behavioral checks. Record evidence,
an owner and a target date for each gap. A checked box records one review step,
not a certification that the application is secure.

Application / owner / review date:
Runtime vendor, exact JDK version, framework versions:
Deployment identity and network exposure:
Sensitive data handled:

| Review area | Evidence to collect | Result / gap / owner / date |
|---|---|---|
| Supported runtime | Runtime inventory and patch procedure | |
| Dependencies | Resolved dependency tree, vulnerability findings and triage | |
| Authorization | Tests for cross-user object access and privileged operations | |
| Untrusted input | Size and format limits; parameterized SQL; output encoding | |
| Outbound requests | Approved destinations, redirect policy and egress rules | |
| TLS | Valid-chain success, hostname mismatch and untrusted-chain rejection tests | |
| Secrets | Approved secret store, scoped access, rotation and log redaction | |
| Deserialization | Trust boundary; allowlisted types and graph limits if unavoidable | |
| Legacy sandbox | Search for SecurityManager, java.security.policy and doPrivileged | |
| Isolation | OS/container identity, filesystem access and network restrictions | |
| Observability | Security event visibility without passwords, tokens or customer payloads | |

## Worked review example (fictional)
Finding: an invoice endpoint uses a bound numeric ID but omits an ownership check.
Impact: a signed-in user might retrieve another user's invoice by changing the ID.
Fix: enforce ownership or an explicit privileged role at the service boundary.
Verification: user A's invoice succeeds for A; fails for user B; authorized staff
path follows the stated policy. Include both authorized and unauthorized cases.
Bound SQL parameters address SQL parsing; authorization addresses who may read.

## Release decision
Unresolved findings and business impact:
Accepted exceptions, approver and expiry:
Tests and evidence locations:
Next review trigger (JDK/framework update, new input boundary or changed privileges):

Primary references:
https://www.oracle.com/java/technologies/javase/seccodeguide.html
https://docs.oracle.com/en/java/javase/25/security/index.html
https://openjdk.org/jeps/486