Java 21

Apply these rules whenever you write or review Java 21. Validate values at runtime where they enter the process, cross a privilege boundary, or return from code with a different trust level.

Assume framework binding, reflection, serialization, native code, and generated code can bypass ordinary type guarantees unless explicitly constrained.

Input and domain boundaries

• Validate type, length, syntax, range, encoding, and allowed values before constructing domain objects from untrusted input.
• Use records with immutable or defensively copied components, or dedicated request types, and reject unknown properties for privileged commands.
• Keep server-generated ownership, role, price, status, and audit fields out of client-bindable types.
• At every protected operation, derive the current actor and tenant from authenticated server context and authorize that actor for the exact action and resource immediately before use. Recheck after an asynchronous wait, reload, or state change, and deny when identity or permission is absent.
• Normalize only after basic validation and make authorization decisions on the same canonical representation used for access.
• Treat environment variables, properties, headers, message metadata, database text, and service responses as untrusted.
• Build every SQL statement with PreparedStatement placeholders and bind values through setXxx; do not concatenate request data into JDBC, JPQL, HQL, or Criteria string fragments.
• Keep table names, column names, ordering, and other SQL structure on a server-side allowlist, because binding protects