Quarkus 3.40

Apply these rules to Quarkus 3.40 applications and their selected extensions. This composition uses the Java 25 baseline; check the actual JDK and native-image toolchain against Quarkus compatibility documentation.

Authorization and identity

• Deny unannotated Jakarta REST endpoints with quarkus.security.jaxrs.deny-unannotated-endpoints=true; explicitly mark public endpoints and use @RolesAllowed, @Authenticated, or @PermissionsAllowed for protected operations. Check object ownership and tenant membership inside the service operation as well as at the HTTP boundary.
• Review quarkus.http.auth.permission.* against every route and HTTP method, including static resources and non-REST handlers. The most specific path wins; method-specific permissions can override broader matches. Use shared=true for a matching policy that must also run, and test the combined path and annotation policy with anonymous and lower-privilege callers.
• Secure every REST Data Panache resource interface (PanacheEntityResource, PanacheRepositoryResource and the MongoDB variants): its generated list, get, add, update and delete operations, including HAL variants, are HTTP endpoints.
• Declare roles with @RolesAllowed, @Authenticated, @PermissionsAllowed or @ResourceProperties(rolesAllowed = ..., authenticated = true), set @MethodProperties(exposed = false) on operations the application doesn't need, and treat @PermitAll on one operation as a deliberate override of resource-level roles. Test each generated operation, especially those customized with @MethodProperties,