/devkit.java.security-review

allowed-tools: Read, Grep, Glob, Bash, Task
argument-hint: "[scope] [options]"
description: Validates security posture for Java enterprise applications (Spring, Jakarta EE, etc.). Use when auditing application security or before production deployments.

Overview

Validates security posture for Java enterprise applications (Spring, Jakarta EE, etc.). Use when auditing application security or before production deployments.

Usage

/devkit.java.security-review $ARGUMENTS

Arguments

| Argument | Description | |--------------|------------------------------------------| | `$ARGUMENTS` | Combined arguments passed to the command |

Execution Steps

Execute comprehensive security review for Java enterprise applications. Analyze vulnerabilities, dependencies, security configurations, and best practices specific to the Java ecosystem.

Execution Steps

1. **Setup Analysis Environment**

• Prepare codebase for review
• Configure security scanning tools
• Set up reporting framework

2. **Automated Security Scanning**

• Run dependency vulnerability scans
• Execute static analysis security rules
• Perform configuration security checks

3. **Manual Security Review**

• Review authentication/authorization logic
• Analyze input validation patterns
• Check error handling security

4. **Generate Security Report**

• Consolidate findings from all tools
• Prioritize vulnerabilities by risk
• Provide actionable remediation steps

5. **Security Recommendations**

• Framework-specific security improvements
• Code pattern recommendations
• Configuration security enhancements
• Monitoring and alerting setup

Target: $ARGUMENTS

Execution Instructions

**Agent Selection**: To execute this security review, use the following agent with fallback:

• Primary: `java-security-expert`
• If not available: Use `developer-kit:java-security-expert` or fallback to `general-purpose` agent with

`spring-boot-crud-patterns` skill

Security Analysis for Java Enterprise Applications

Main Analysis Areas

**Security Review Scope**: $ARGUMENTS

1. OWASP Top 10 Vulnerability Analysis for Java

Analyze the following vulnerability categories in Java context:

A01: Broken Access Control

• Verify Spring Security configurations (@PreAuthorize, @Secured)
• Analyze method-level and URL access controls
• Check JWT and OAuth2 implementations
• Verify Role-Based Access Control (RBAC)

A02: Cryptographic Failures

• Analyze cryptographic algorithms usage (JCA, Bouncy Castle)
• Verify password management (BCrypt, PBKDF2)
• Check SSL/TLS configurations
• Review key and secrets management

A03: Injection

• SQL Injection in JPA/Hibernate (JPQL, Criteria API)
• NoSQL Injection (MongoDB, Cassandra)
• Command Injection (ProcessBuilder, Runtime.exec)
• LDAP Injection in JNDI

A04: Insecure Design

• Missing layered security architecture
• Insecure design patterns (Singleton, Prototype)
• Lack of Domain-Driven Design for security
• Unclear separation of responsibilities

A05: Security Misconfiguration

• Insecure Spring Boot configurations
• Exposed Actuator endpoints
• Unprotected database connection pools
• Missing CORS and security headers

A06: Vulnerable and Outdated Components

• Maven/Gradle dependency scanning (OWASP Dependency-Check)
• Libraries with known CVEs
• Outdated Spring/Jakarta EE versions
• Vulnerable transitive dependencies

A07: Identification and Authentication Failures

• Inadequate Spring Security configurations
• Insecure session management
• Weak password policies
• Incorrectly implemented MFA

A08: Software and Data Integrity Failures

• Verify JAR/WAR signatures integrity
• Missing data integrity controls
• Unimplemented anti-tampering
• Secure deserialization (Java serialization)

A09: Security Logging and Monitoring Failures

• Inadequate security logging (Logback, Log4j)
• Missing audit trail
• Absent security event monitoring
• Unimplemented intrusion detection

A10: Server-Side Request Forgery (SSRF)

• Analyze HTTP/HTTPS calls (RestTemplate, WebClient)
• Missing URL validation
• Insecure proxy configurations
• File inclusion attacks

2. Spring Security Analysis

Configuration Analysis

• @EnableWebSecurity configurations
• PasswordEncoder implementations
• Authentication providers setup
• HTTP security rules (authorizeRequests())

Authentication & Authorization

• JWT implementation security
• OAuth2/OpenID Connect setup
• Method-level security (@PreAuthorize, @Secured)
• Role-based access control patterns

Session Management

• Session fixation protection
• Concurrent session control
• Session timeout configuration
• State vs Stateless authentication

3. Dependencies and Libraries Analysis

Maven/Gradle Dependency Analysis

# Run vulnerability scan
mvn dependency:tree
mvn org.owasp:dependency-check-maven:check

Critical Libraries to Review

• Spring Framework versions
• Jakarta EE implementations
• Database drivers (JDBC)
• JSON libraries (Jackson, Gson)
• Crypto libraries (Bouncy Castle)
• HTTP clients (Apache HttpClient, OkHttp)

4. Database Security

JPA/Hibernate Security

• SQL injection in JPQL queries
• N+1 query problems
• Lazy loading security issues
• Entity access control

Connection Security

• Connection pool configuration
• Database credential management
• SSL/TLS database connections
• Stored procedure security

5. API Security

REST API Security

• Input validation (Jakarta Bean Validation)
• Rate limiting implementation
• API authentication patterns
• Response security headers

Microservices Security

• Service-to-service authentication
• API gateway security patterns
• Circuit breaker security
• Distributed tracing security

6. Containerization and Cloud Security

Docker/Kubernetes Security

• Container base image security
• Secrets m