Google Gen AI SDK for Java 1.70.0

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. Google Gen AI SDK for Java 1.70.0109 lines · 4.9K tokens
Total222 lines · 7.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 94
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 294
  • 295
  • 297
  • 319
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply the Java 25 baseline first. These rules cover com.google.genai:google-genai:1.70.0, including the Gemini Developer API, Gemini Enterprise Agent Platform backend, and bundled interactions, agents, environments, and webhooks. The artifact targets Java 8 bytecode; Java 25 is the deployment baseline, not the SDK's minimum runtime.

Backend selection and credential resolution

  • Construct reusable Client instances in trusted startup code; keep backend, project, location, API version, model, and endpoint selection outside request and model control.
  • Select .enterprise(true) or .enterprise(false) explicitly; avoid mixing it with .vertexAI(...), since conflicting explicit flags throw while conflicting environment flags merely warn and prefer GOOGLE_GENAI_USE_ENTERPRISE.
  • Use explicit project and location with narrowly scoped workload credentials for the Enterprise backend, or an API key for express mode; reject ambiguous mixtures instead of relying on environment precedence.
  • Supply Developer API keys only to trusted server clients, restrict them to the intended API and deployment, and set only one key source; GOOGLE_API_KEY wins over GEMINI_API_KEY when both exist.
  • Control Application Default Credentials configuration, including GOOGLE_APPLICATION_CREDENTIALS; accept credential files and federation configuration only from trusted deployment administration.
  • Separate clients and provider projects where workloads need distinct identities, regions, quotas, or isolation; enforce application ownership checks even when resources share the same provider