Java Application Security

REFERENCE MODE: This skill provides reference material for Java application security. Load specific standards on-demand based on current task. Do not load all standards at once.

This skill is a thin pointer: it carries only Java-specific security mechanics and delegates the cross-cutting conceptual foundations (OWASP Top 10, STRIDE, secrets lifecycle, secure-logging principles, trust-boundary architecture, secure-design principles) upward to Skill: plan-marshall:persona-security-expert. There is no content duplication — the normative conceptual rules live in that persona's standards/ only; this skill explains how those rules are realized in Java.

Enforcement

Execution mode: Reference library; load standards on-demand for Java security review and hardening tasks.

Prohibited actions:

• Do not log authentication tokens, passwords, secrets, certificate contents, PII, or session identifiers
• Do not hardcode secrets in source; resolve all secrets from external configuration
• Do not silently coerce invalid inbound data; reject on any constraint violation at the trust boundary
• Do not leak internal details (paths, credentials, stack internals) in error messages returned to callers