Backend Java

JB47 · Spring configuration files reference secrets through placeholders instead of literal passwords, tokens or keys

JB47 · Credential-named constants and variables are not initialized with literal values

JB47 · Logs never receive passwords, tokens, keys, authorization headers or card data

JB32 · The user approves broad permit-all rules, disabled CSRF or headers, ignored paths and credentialed wildcard CORS

JB32 · The user approves configuration that exposes every actuator endpoint or turns security off

JB29 · Request bodies and bound forms are validated (@Valid/@Validated) before they reach the service

JB30 · A request body bound directly to a JPA entity is flagged for an explicit input contract (entity from jdtls)

JB30 · Request data is not copied wholesale onto entities (copyProperties, readerForUpdating, map-into-entity)

JB36 · The user confirms SQL text built by concatenating or formatting non-constant values

JB46 · XML parsers and transformers disable DTDs and external entities in the class that creates them

JB48 · Shell commands, expressions, deserialization, paths and URLs are not built from request data or untyped strings

JB32 · TLS certificate and hostname verification is never disabled (trust-all managers, allow-all verifiers)

JB10 · Suppressions are scoped to the smallest element and name their reason (no class-wide or blanket suppression)

JB66 · The user authorizes build or CI changes that skip tests or analysis, ignore failures or drop a check

JB11 · No new raw generic types or unchecked generic casts in application logic

JB13 · Methods declared to return Optional or a non-null value never return null

JB14 · Methods returning collections, streams or arrays return an empty value for "no results", not null

JB23 · A catch block never swallows a failure silently nor reports success after it

JB24 · Catching Exception, Throwable or Error is a boundary handler that logs or rethrows

JB25 · An exception translated in a catch block keeps the caught one as its cause

JB28 · A failure is logged once at its owning boundary, not logged and rethrown at every layer

JB26 · A caught InterruptedException is propagated or the interrupt flag is restored

JB49 · Singleton beans do not keep request-specific mutable state in fields

JB50 · Lazily initialized shared fields are safely published (no double-checked locking without volatile, no shared DateFormat)

JB51 · A call returning a Future, CompletableFuture, Mono or Flux is not discarded by a statement (type from jdtls)

JB51 · Asynchronous work started by a statement has an owner for its failure (no discarded runAsync, submit or then* chain)

JB52 · Executors and threads have an owner, a capacity policy and a shutdown lifecycle (not created per call)

JB53 · Reactive methods (Mono/Flux) do not block (block(), Thread.sleep, JDBC) without explicit offloading

JB54 · Work started on another thread does not assume the caller's transaction or security context

JB27 · Owned streams, files, sockets, connections and statements are closed on every path (try-with-resources)

JB35 · Externally triggered reads are bounded (pagination or limits), not repository findAll()

JB41 · Repository and remote fetches are batched, not issued once per item of a loop

JB43 · HTTP clients and requests are built with finite connect and read deadlines

JB44 · Retries are bounded (attempts or deadline); no infinite retry loop or retry() without limit

JB45 · Owned HTTP responses (OkHttp, Apache, JAX-RS, streamed JDK bodies) are closed on every path

JB01 · Imports respect the project's declared dependency map (off until dependencyRules is set)

JB04 · Required services are injected through the constructor into final fields, not by field or setter injection

JB05 · Application-context lookups and service locators stay in composition and infrastructure code

JB21 · Business logic reads the current time from an injected Clock, not from the system clock

JB16 · Records holding collections, arrays or Dates copy them defensively instead of exposing mutable internals

JB17 · A class that overrides equals also overrides hashCode with a compatible definition

JB18 · Strings and boxed values are compared with equals, not == or !=

JB18 · Variables typed as strings, boxed numbers, BigDecimal, java.time or UUID values are not compared with == (types from jdtls)

JB19 · Arithmetic on BigDecimal, BigInteger, String or java.time values is not discarded (receiver type from jdtls)

JB19 · Results of pure methods (String, java.time, BigDecimal scaling, unterminated streams) are used, not discarded

JB20 · Byte/text conversions name their charset instead of relying on the platform default

JB22 · Money and exact quantities keep their precision (no BigDecimal from double, no unbounded divide, no float money)

JB33 · Spring Boot configuration does not include stack traces, exception names or messages in error responses

JB33 · Exception messages and stack traces are not written into HTTP responses

JB37 · A method with several repository writes is transactional or states its consistency protocol

JB38 · A @Transactional method is not called on this from a non-transactional method of the same class (proxy bypass)

JB39 · A @Transactional method that throws checked exceptions declares its rollback rules

JB40 · Remote calls, messaging and sleeps do not run while a database transaction is held open

JB42 · A persisted entity change ends the turn with a Flyway or Liquibase migration (projects with db/migration or db/changelog)

JB55 · Production code reports through the logging system, not System.out/err or printStackTrace

JB64 · Build files pin dependencies (no dynamic, range, LATEST/RELEASE or SNAPSHOT versions)

JB10 · Disabled tests say why (@Disabled("reason")); tests are not skipped silently

JB58 · Tests assert an outcome or a specified interaction; assertions are not tautologies

JB61 · Routine tests do not sleep for fixed durations or call public network hosts

JB62 · Test classes do not share mutable static state between tests

Records the work tree when a prompt starts, the baseline of the end-of-turn checks (JB56, JB42)

JB09 · Production code ships implemented behavior, not TODO throws, stub returns or empty TODO bodies

JB56 · Claude does not end a turn with compiler errors it introduced in Java sources or their dependents (jdtls)

JB66 · A final message claiming a passing build or tests needs a successful run after Claude's last edit

JB66 · Records, per session, Claude's edits and the build or test runs (Maven, Gradle) that succeeded after them