The threat model
Never deserialize untrusted input with default ObjectInputStream. Attackers chain gadget classes already on your classpath to run arbitrary code.
The rest of this guide is part of Pro
Free covers every fresher guide in full. Pro unlocks Senior, Staff and Architect guides across every track.
Test yourself
Answer these before moving on — recall is what makes it stick.