# Security Baked Into the JVM: the Safe Codebase Audit Pipeline

DevFeed: [Security Baked Into the JVM: the Safe Codebase Audit Pipeline](<https://devfeed.tech/articles/security-baked-into-the-jvm-the-safe-codebase-audit-pipeline-18929.md>)

Original publisher: [Read original article](<https://blog.frankel.ch/security-baked-into-jvm/2/>)

Author: Peter Firmstone

Published: 2026-07-19T00:00:00Z

Content type: article

Language: en

Sources: [Nicolas Fränkel](<https://devfeed.tech/sources/nicolas-frankel.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Java](<https://devfeed.tech/topics/java.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [bytecode](<https://devfeed.tech/tags/bytecode.md>), [dirtychai](<https://devfeed.tech/tags/dirtychai.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [java](<https://devfeed.tech/tags/java.md>), [jgdms](<https://devfeed.tech/tags/jgdms.md>), [jini](<https://devfeed.tech/tags/jini.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [systems](<https://devfeed.tech/tags/systems.md>), [technical](<https://devfeed.tech/tags/technical.md>)

## AI overview

This article presents the Safe Codebase Audit Pipeline, or SCAP, for analyzing third-party Java JARs before clients deserialize objects from them. It focuses on supply-chain risks from malicious bytecode and blocking static initializers, and describes distributing the pipeline across hosts with separate responsibilities and restricted network access.

## Source excerpt

In Part 1, the minimal deployment showed constraints traveling with the proxy: authentication, encryption, hardened deserialization, all declared in configuration and enforced at the call boundary. The proxy is a JAR. That JAR was downloaded and unmarshalled before any constraint ran. That step is the earlier problem. Distributed Java systems that load remote code are vulnerable to supply chain compromise: an attacker can replace a legitimate JAR with one containing malicious bytecode.