# j3ers3/Hello-Java-Sec

☕️ Java Security，安全编码和代码审计

Repository: https://github.com/j3ers3/Hello-Java-Sec
Canonical: https://ross.abutalabs.com/products/hello-java-sec
Language: Java
License Family: other
Topics: java-sec, java-vul, code-audit
Last push: 2025-03-07T06:16:56+00:00

## Health v2 (maintenance only)
Score: 27/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 10, release rhythm 8, longevity 100
- inputs: {"age_days": 1886, "days_push": 544, "days_rel": 644, "gap_med": null, "n_releases_24m": 1}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1763, forks 258 (observed 2026-08-28T04:05:32.924958+00:00)

## What it is
A deliberately vulnerable Java Spring Boot application demonstrating common web vulnerabilities (SQLi, XSS, RCE, deserialization, SSTI, SSRF, XXE, Log4shell, JWT flaws, and more) alongside secure coding examples. It is designed as a training platform for security and development teams to learn vulnerability principles and practice code auditing.

## Use cases
- practice exploiting java web vulnerabilities in a safe lab
- learn how sql injection and xss work in java spring boot
- train developers on secure coding in java
- test code audit skills against realistic java vulnerabilities
- set up a deliberately vulnerable app with docker for security training
- demonstrate log4shell and fast deserialization attacks
- study secure vs vulnerable code side by side

## When to choose
- you need a hands-on vulnerable Java target for security training or CTF practice
- you want to teach developers secure coding with real vulnerable vs fixed code examples
- you are practicing code auditing on Java Spring Boot applications

## When to avoid
- you need a production-ready secure application - this is intentionally vulnerable
- you need a vulnerability scanner or automated audit tool - this is a training app, not a tool
- you require a maintained, licensed codebase for commercial use - it has no license

## Facets
- artifact type: application
- maturity: active
- function: security, penetration-testing, vulnerability-scanning, testing
- domain: security, penetration-testing, developer-tools, education, web-development
- platform: jvm, self-hosted
- tags: java-security, code-audit, vulnerable-app, security-training, deliberately-vulnerable, spring-boot, owasp, vulnerability-lab, education, docker, web-server

## Member repositories
- j3ers3/Hello-Java-Sec (main) score 27

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:32.924958+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:26:46.486476+00:00, confidence not recorded.
  - readme: https://github.com/j3ers3/Hello-Java-Sec (fetched 2026-08-28T04:05:32.924958+00:00, sha 0de1ac005cea)
- Data as of 2026-08-30T08:39:29.467469+00:00.