Lightning Talk (Defensive by Design: Applying OWASP Top 10 to Secure Java Enterprise APIs)

​Modern Java enterprise systems rely heavily on APIs, yet most real-world breaches stem from predictable design and implementation mistakes rather than exotic attacks. This session explores how the OWASP Top 10 maps directly to common pitfalls in Java EE and Spring Boot–based APIs, from broken access control to insecure design and misconfiguration. Using practical Spring Security and JPA examples, we’ll show how to shift security left—embedding authorization, validation, and trust boundaries directly into service and domain layers—so APIs remain secure, predictable, and resilient under real production traffic.