Java Review

Security

• SQL injection (raw string concatenation in queries)
• Unvalidated user input reaching sensitive operations
• Hardcoded secrets or credentials
• Insecure deserialization
• Path traversal vulnerabilities
• Logging sensitive data

Design & Maintainability

• SOLID principle violations
• God classes or methods (excessive responsibility)
• Mutable state exposed via getters (returning internal collections directly)
• Missing or incorrect use of access modifiers
• Raw types instead of parameterized generics

Java-Specific Best Practices

• Use of Optional vs null returns for APIs
• Proper use of records, sealed classes (Java 17+)
• Preferring List.of/Map.of over mutable collections when immutability is intended
• Correct use of var (local variable type inference)
• Appropriate use of functional interfaces and lambdas

Output Format

For each finding, report:

1. File and line number — path/to/File.java:42
2. Severity — CRITICAL / WARNING / INFO
3. Category — from the checklist above
4. Issue — brief description
5. Suggestion — concrete fix or improvement

Summarize findings at the end grouped by severity. If the code is clean, say so — don't invent issues.