spring-boot
Safeguard articles tagged "spring-boot" — guides, analysis, and best practices for software supply chain and application security.
13 articles
Preventing mass assignment in Spring MVC and Spring Boot
CWE-915 mass assignment lets one extra JSON field turn a profile update into a privilege escalation — here's how DTOs beat @JsonIgnore in Spring.
Java DTOs for secure data handling
A single @RequestBody bound to a JPA entity can let attackers set fields like isAdmin — DTOs close that gap by design, not by discipline.
Using jlink to Build Minimal, Lower-Attack-Surface Java Docker Images
jlink has shipped with every JDK since Java 9 in 2017, yet most Spring Boot images still ship a full 300MB+ JDK. Here's how to fix that.
Robust input validation in Spring Boot: Bean Validation and its bypasses
Bean Validation (JSR-380) looks like a solved problem in Spring Boot, but nested DTOs, list elements, and unannotated service methods routinely skip validation silently.
The most common Spring Boot security misconfigurations, and how to fix them
CVE-2026-40976 let anonymous users hit /actuator/env and /actuator/heapdump on default Spring Boot 4 filter chains, CVSS 9.1 — here's how to actually harden Spring Boot.
Thymeleaf SSTI risk patterns: how a tab character bypassed a Java template sandbox
CVE-2026-40478 shows how a single tab character bypassed Thymeleaf's expression sandbox, turning misused templates into remote code execution.
Spring Boot Security Best Practices: Hardening the Defaults
Spring Boot's convenience defaults can quietly widen your attack surface. Here's how to harden actuators, dependencies, and auto-configuration for 2026.
spring-boot-starter-security: Secure Defaults and Common Mistakes
What actually happens when you add spring-boot-starter-security to your build, the defaults it turns on, and the configuration mistakes that quietly undo them.
org.apache.tomcat.embed: Embedded Tomcat Versions and Vulnerabilities
org.apache.tomcat.embed ships inside almost every Spring Boot jar, and its CVEs follow it there. Here is how to find your real embedded Tomcat version and patch it.
CVE-2023-20873: The Spring Boot Cloud Foundry Auth Bypass Explained
A clear breakdown of CVE-2023-20873, the Spring Boot security bypass on Cloud Foundry: affected versions, why wildcard matching caused it, and how to fix it.
Spring Boot Logging Best Practices That Keep Secrets Out of Your Logs
Spring Boot logging best practices focused on security: structured logs, keeping secrets and PII out, safe log levels, and avoiding the mistakes that turned Log4Shell into a catastrophe.
Spring Dependency Management Supply Chain
Spring Boot's dependency management is the unsung hero of the Java ecosystem, and it is also a supply chain seam worth understanding. Here is how BOMs, starters, and transitive version coercion shape what actually ships.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.