---
title: "Ten Ways to Secure your Applications"
description: "The post, adapted from Joe Kutner’s Devoxx 2018 talk, presents ten ways to strengthen web application security, with examples focused on Java but applicable to modern languages. It recommends keeping dependencies current, validating explicit payloads with schemas, checking regular expressions for ReDoS, throttling abusive requests, and keeping credentials outside the codebase. It also advises secure-first coding, certificate validation for outgoing connections, logging security-relevant actions without recording secrets, and monitoring suspicious behavior with tools such as AppSensor. The examples include Maven Versions Plugin, Snyk, Bucket4j, saferegex, environment variables, and EnvKeyStore, with a token-bucket algorithm proposed for request throttling. The conclusion is that security requires anticipating unintended functionality across network, platform, and physical domains, while these practices provide a starting point."
---

# Ten Ways to Secure your Applications

[Heroku](https://yomu.fyi/company/heroku) · Joe Kutner · Feb 21, 2019

**Type:** Explainer

## Summary

The post, adapted from Joe Kutner’s Devoxx 2018 talk, presents ten ways to strengthen web application security, with examples focused on Java but applicable to modern languages. It recommends keeping dependencies current, validating explicit payloads with schemas, checking regular expressions for ReDoS, throttling abusive requests, and keeping credentials outside the codebase. It also advises secure-first coding, certificate validation for outgoing connections, logging security-relevant actions without recording secrets, and monitoring suspicious behavior with tools such as AppSensor. The examples include Maven Versions Plugin, Snyk, Bucket4j, saferegex, environment variables, and EnvKeyStore, with a token-bucket algorithm proposed for request throttling. The conclusion is that security requires anticipating unintended functionality across network, platform, and physical domains, while these practices provide a starting point.

## Context

Web applications face common security risks from outdated dependencies, unrestricted inputs, unsafe regular expressions, abusive traffic, embedded credentials, improper certificate handling, and insufficient monitoring. The post frames secure implementation as the need to anticipate unintended functionality and address multiple aspects of security.

## Approach / What changed

The post provides ten security practices, including dependency monitoring, explicit request validation, regular-expression analysis, token-bucket throttling, secret storage outside the codebase, certificate validation, security-focused logging, intrusion detection, and personal access controls. It illustrates several practices with Java tools and code examples.

## Takeaways

- JSON schemas can define acceptable request fields and types, while request headers and query parameters also require validation.
- The regular expression (a|aa)+ can take catastrophically long to match crafted input; the saferegex utility reports that it is vulnerable to ReDoS.
- Bucket4j uses a token-bucket algorithm to group incoming requests and throttle or blacklist buckets based on their properties.

**Tags:** [Java](https://yomu.fyi/topic/java), [JSON Schema](https://yomu.fyi/topic/json-schema), [Rate Limiting](https://yomu.fyi/topic/rate-limiting), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/ten-ways-to-secure-your-apps)
- Source URL: https://www.heroku.com/blog/ten-ways-to-secure-your-apps
- Ingested by Yomu: 2026-09-09T14:27:02.389Z

[Read original post](https://www.heroku.com/blog/ten-ways-to-secure-your-apps)