Security Fundamentals

A few defaults worth knowing before shipping a real Java service:

• Never build SQL by string concatenation — always use PreparedStatement placeholders (or an ORM), as shown in JDBC & Database Access.
• Never log or hard-code secrets (API keys, database passwords) — read them from environment variables or a secrets manager instead.
• Validate and sanitize external input before trusting it, whether it's a REST request body, a file, or a query parameter.
• Hash passwords with a purpose-built algorithm (BCrypt, Argon2) — never store them in plain text, and never use a general-purpose hash like MD5 or plain SHA-256 for passwords.

Common mistakes

• Rolling a custom authentication or password-hashing scheme instead of using an established, audited library or framework feature (like Spring Security) — security code is exactly where reinventing the wheel is most likely to introduce a serious vulnerability.