Java & Spring Boot code review bible (staff)

01What staff-level code review grades

02Staff principles — with snippets

Order checkout(String userId, String code, boolean isGift, boolean express) {
  // … 80 lines: load, validate, price, tax, ship, save, email …
  double total = subtotal * 1.08;           // money bug
  if (code == "SAVE10") total *= 0.9;       // == bug
  return db.save(total);
}

void onWebhook(Event e) {
  payments.charge(e.orderId, e.amount);
}

Document get(long id) { return db.find(id); }
Document update(long id, Body b) { db.update(id, b); return db.find(id); }
void delete(long id) { db.delete(id); }
// three local “add owner check” comments vs one design comment

double calculateDiscount(String code, double subtotal, boolean isGift, boolean express) {
  if ("SAVE10".equals(code) && subtotal > 0) return subtotal * 0.1;
  return 0; // isGift / express never read
}

// Systemic fix shapes to propose
Money price(Cart cart);                    // pure pricing
void requireOwner(Req req, Doc doc);       // shared ownership
inflight.computeIfAbsent(key, k -> load);  // single-flight cache

03Comment priority order — with snippets

double tax = total * 0.08; // BLOCKER — mis-bills

if (redis.get(key) == null) redis.set(key, token); // BLOCKER race
charge(event); // every webhook delivery — BLOCKER without idempotency
new ProcessBuilder("/bin/sh", "-c", modelCmd).start(); // BLOCKER RCE

cache.put(key, feed); // never evicts — BLOCKER leak + stale
// N concurrent misses all loader.load(key) — BLOCKER stampede
userIds.forEach(id -> supplyAsync(() -> buildFeed(id), cachedPool)); // BLOCKER herd

if (now - fetchedAt < ttlMs) refresh(); // HIGH — inverted TTL
for (User u : users) db.findOrdersByUser(u.id); // HIGH N+1
HttpClient c = HttpClient.newHttpClient(); // HIGH per call
if (user == null) return null; else throw ...; // HIGH inconsistent contract

Order checkout(...) { /* load, price, save, email — god method */ }
while (!acquire()) { /* spin — missing backoff */ }
public Map<String, Boolean> cache; // leaky abstraction

if (subtotal > 5000) ... // NIT — name FREE_SHIPPING_THRESHOLD_CENTS
String env = "prod"; // NIT — Environment enum
// extract helper for readability after blockers

04How to run a staff code-review interview (45–60 min)

1. Minute 0–5 — map the system. Find the public entry (controller/handler/main). Trace one happy path aloud: inputs → storage → outbound calls → response. List side effects (charge, email, cache write, lock).
2. Minute 5–15 — correctness & safety first. Money math, authz/IDOR, SQL injection, check-then-set locks, idempotency on webhooks. Say each finding as: symptom → failure mode → fix shape → severity.
3. Minute 15–35 — load & ops. N+1, sequential fanout, unbounded pools, cache stampede/TTL, timeouts/retries, DLQ, logging secrets.
4. Minute 35–45 — design & maintainability. God methods, inconsistent null/throw, leaky SDK fields, missing tests for the risky path. Keep these after blockers.
5. Last 5 — close. “Three blockers: … Two highs: … Nits: … I’d merge only after blockers.” Ask one clarifying question if intent was ambiguous.

05The finding template — worked example

class RedisLock {
  boolean acquire(String key, String token, long ttlMs) {
    if (jedis.get(key) == null) {          // (1) location
      jedis.set(key, token);               // separate round-trip
      jedis.pexpire(key, ttlMs);
      return true;
    }
    return false;
  }
  void release(String key) {
    jedis.del(key);                        // no token compare
  }
}

// Fix shape
String ok = jedis.set(key, token, SetParams.setParams().nx().px(ttlMs));
return ok != null;

// release: Lua if get==token then del

Document get(long id) { return db.findById(id); } // no owner check
void delete(long id) { db.delete(id); }           // no owner check

06Failure-mode taxonomy (hunt in this order)

1. Money / truth: double/float cash, string ==, false vs null flags, coupon/tax literals, wrong cache key dimensions.
2. Safety / exclusivity: check-then-set locks, unsafe unlock, missing single-flight, TOCTOU on files.
3. Security: IDOR, SQLi, path traversal, secrets in repo, unsigned webhooks, shell/RCE, model-supplied userId.
4. Reliability: no idempotency, swallowed markPaid, receipt on critical path, empty tool errors, dropped DLQ jobs.
5. Scale / resources: N+1, sequential independent I/O, unbounded pools/batch, forever cache, PBKDF2-per-item, per-call HttpClient, huge bodies.
6. Contracts / shape: null vs throw mix, positional booleans, public mutable fields, god methods — after the above.

// Money/truth
double tax = total * 0.08;
if (code == "SAVE10") ...
return (value != null && value) ? value : def; // false collapsed

// Safety
if (get(k)==null) set(k,t);
jedis.del(k);

// Security
db.findById(id); // no owner
query("... id=" + id);
/bin/sh -c modelCmd;

// Reliability
charge(e); // no dedupe
catch (Exception e) { return ""; } // tool errors

// Scale
for (s : sources) fetch(s);
new HttpClient() per call;
cache.put forever;

// Contracts/shape (last)
checkout does everything; public Map cache;

07Hire bar — what interviewers write after you leave

• Did I find ≥1 money/correctness bug if money exists in the snippet?
• Did I find ≥1 authz/injection/secret issue if there’s an HTTP surface?
• Did I find ≥1 race/idempotency/timeout issue if there’s concurrency or webhooks?
• Did I find ≥1 scale/resource issue if there’s fanout, cache, or batch APIs?
• Did I give a ranked closing summary?

08Company formats you’ll see

09Verbal bank — high-signal phrases

// “Failure mode is double-charge / blast radius is money”
charge(event); // no wasProcessed(event.id)

// “Check-then-act — needs one atomic op”
if (get(key)==null) set(key, token);

// “At-least-once → need idempotency”
onWebhook → charge every delivery

// “Pure function so we can unit-test without fakes”
Money price(Cart c);

// “Systemic fix is shared ownership guard”
requireOwner(req, doc);

// “Severity blocker — wouldn’t merge”
// “Is this unfinished intent or dead code?”

10Money & numeric correctness

// BROKEN — double money
double tax = total * 0.08;
double discount = subtotal * 0.1;
order.setTotal(total + tax - discount);
email.send(order.getTotal()); // may print 19.999999999998

// FIX — integer cents + explicit rounding at the boundary
long taxCents = Math.round(totalCents * TAX_RATE_BPS / 10_000.0);
// or BigDecimal with RoundingMode.HALF_UP at the API boundary
long payable = totalCents + taxCents - discountCents;
order.setTotalCents(payable);

// BROKEN
if (code == "SAVE10") return subtotal * 0.1;

// FIX — literal first so null code is safe
if ("SAVE10".equals(code)) return rateOf(code) * subtotal;

// BROKEN — false and missing look the same
return (value != null && value) ? value : defaultValue;

// FIX — distinguish null from false
return value == null ? defaultValue : value;

if (subtotal > 5000) shipping = 0;
else shipping = 1500;
double tax = total * 0.08;

private static final long FREE_SHIPPING_THRESHOLD_CENTS = 5_000;
private static final long STANDARD_SHIPPING_CENTS = 1_500;
private static final double TAX_RATE = 0.08;

11Structure, contracts & readability

Order checkout(userId) {
  User u = db.user(userId);
  Cart c = db.cart(userId);
  // validate… subtotal… coupon… tax… shipping…
  Order o = db.save(...);
  mailer.send(o);
  return o;
}

Money price(Cart cart) { /* pure: subtotal, coupon, tax, ship */ }

Order checkout(userId) {
  User u = requireUser(userId);
  Cart c = requireCart(userId);
  Money priced = price(c);
  Order o = db.save(u, priced);
  mailer.send(o); // side effect after persist
  return o;
}

if (user == null) return null;
if (cart == null) return null;
if (cart.isEmpty()) throw new IllegalStateException("empty");

User user = userRepo.find(id).orElseThrow(() -> new NotFound("user"));
Cart cart = cartRepo.find(id).orElseThrow(() -> new NotFound("cart"));
if (cart.isEmpty()) throw new InvalidCart("empty");

if (user != null) {
  if (cart != null) {
    if (!cart.isEmpty()) {
      // happy path buried
    }
  }
}

if (user == null) throw new NotFound("user");
if (cart == null) throw new NotFound("cart");
if (cart.isEmpty()) throw new InvalidCart("empty");
// happy path at column 0

if ("SAVE10".equals(code) && subtotal > 0) return subtotal * 0.10;
if ("SAVE20".equals(code) && subtotal > 0) return subtotal * 0.20;
if ("SAVE30".equals(code) && subtotal > 0) return subtotal * 0.30;

private static final Map<String, Double> RATES = Map.of(
  "SAVE10", 0.10, "SAVE20", 0.20, "SAVE30", 0.30);
Double rate = RATES.get(code);
if (rate == null || subtotal <= 0) return 0;
return subtotal * rate;

12Locks, workers & interruption

// BROKEN
if (redis.get(key) == null) {
  redis.set(key, token, ttl);
  return true;
}
return false;

// FIX — single atomic op
String ok = redis.set(key, token, SetParams.setParams().nx().px(ttlMs));
return ok != null; // null => someone else holds it

// BROKEN
redis.del(key);

// FIX — atomic compare-and-delete (Lua)
// if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end

while (!acquire()) {
  // spin
}

while (!acquire()) {
  try {
    Thread.sleep(backoffMs);
  } catch (InterruptedException e) {
    Thread.currentThread().interrupt();
    return false;
  }
  backoffMs = Math.min(max, backoffMs * 2);
}

try {
  doJob();
} catch (Exception e) {
  attempts++;
}

try {
  doJob();
} catch (InterruptedException e) {
  Thread.currentThread().interrupt();
  break;
} catch (JobException e) {
  log.warn("job failed", e);
  attempts++;
}

} catch (Exception e) {
  attempt++;
}
// loop ends — lock released — silence

} catch (Exception e) {
  log.error("job {} failed attempt {}", jobId, attempt, e);
  if (attempt >= maxAttempts) {
    deadLetter.enqueue(jobId, e);
    break;
  }
  attempt++;
}

13Performance & ranking

List<User> users = db.findAllUsers();
for (User u : users) {
  List<Order> orders = db.findOrdersByUser(u.getId()); // N+1
  ...
}

-- Prefer DB-side aggregation
SELECT user_id, SUM(amount_cents) AS spent
FROM orders
GROUP BY user_id
ORDER BY spent DESC
LIMIT 100;

for (Order o : orders) {
  items.addAll(db.findItemsByOrder(o.getId()));
}

Map<Long, List<Item>> byOrder = db.findItemsByOrderIds(orderIds);
for (Order o : orders) {
  items.addAll(byOrder.getOrDefault(o.getId(), List.of()));
}

users.sort((a, b) -> (int) (b.getSpent() - a.getSpent()));

users.sort((a, b) -> Long.compare(b.getSpent(), a.getSpent()));

for (Row r : sorted) {
  int rank = 1;
  for (Row o : sorted) if (o.spent > r.spent) rank++;
  r.rank = rank;
}

for (int i = 0; i < sorted.size(); i++) {
  // handle ties explicitly if needed
  sorted.get(i).rank = i + 1;
}

for (var e : counts.entrySet()) {
  if (e.getValue() > bestCount) { best = e.getKey(); bestCount = e.getValue(); }
}

// Explicit tie-break: higher count, then smaller product id
best = counts.entrySet().stream()
  .max(Comparator
    .comparingLong(Map.Entry<String, Long>::getValue)
    .thenComparing(Map.Entry::getKey, Comparator.reverseOrder()))
  .map(Map.Entry::getKey)
  .orElse(null);

14Feed fanout, cache & request-path cost

List<Item> fanOut(List<Source> sources) {
  List<Item> all = new ArrayList<>();
  for (Source s : sources) {
    all.addAll(fetchFromSource(s)); // sequential
  }
  return all;
}

List<CompletableFuture<List<Item>>> futures = sources.stream()
  .map(s -> CompletableFuture.supplyAsync(() -> fetchFromSource(s), upstreamPool))
  .toList();
return futures.stream().map(CompletableFuture::join).flatMap(List::stream).toList();

for (String userId : userIds) { // unbounded
  futures.add(CompletableFuture.supplyAsync(
      () -> buildFeed(userId), Executors.newCachedThreadPool()));
}

if (userIds.size() > MAX_BATCH) throw new BadRequest("batch too large");
ExecutorService pool = Executors.newFixedThreadPool(MAX_IN_FLIGHT_USERS);
try {
  List<CompletableFuture<Feed>> futures = userIds.stream()
    .map(id -> CompletableFuture.supplyAsync(() -> buildFeed(id), pool))
    .toList();
  return futures.stream().map(CompletableFuture::join).toList();
} finally {
  pool.shutdown();
}

String cacheKey(String userId, String region) {
  return "feed:" + userId; // region unused — cross-region bleed
}

String cacheKey(String userId, String region) {
  return "feed:" + userId + ":" + region;
}

List<Item> getCached(String key) {
  List<Item> v = map.get(key);
  return v == null ? List.of() : v; // miss looks like empty hit
}

Optional<List<Item>> getCached(String key) {
  return Optional.ofNullable(map.get(key));
}
// getOrLoad: getCached(key).orElseGet(() -> loadAndStore(key));

cache.put(key, new Entry(feed, System.currentTimeMillis()));
// nothing ever evicts; storedAt unread

// e.g. Caffeine: maximumSize + expireAfterWrite
LoadingCache<String, Feed> cache = Caffeine.newBuilder()
  .maximumSize(10_000)
  .expireAfterWrite(Duration.ofMinutes(5))
  .build(this::loadFeed);

Feed getOrLoad(String key) {
  Feed hit = cache.get(key);
  if (hit != null) return hit;
  Feed loaded = loader.load(key); // every miss does full work
  cache.put(key, loaded);
  return loaded;
}

ConcurrentHashMap<String, CompletableFuture<Feed>> inflight = ...;

Feed getOrLoad(String key) {
  Feed hit = cache.get(key);
  if (hit != null) return hit;
  CompletableFuture<Feed> fut = inflight.computeIfAbsent(key, k ->
      CompletableFuture.supplyAsync(() -> loader.load(k))
        .whenComplete((v, e) -> {
          if (v != null) cache.put(k, v);
          inflight.remove(k);
        }));
  return fut.join();
}

byte[] affinityHash(String itemId) {
  return pbkdf2(itemId, salt, 100_000); // per item, sync
}

long affinityScore(String itemId, String userId) {
  return murmur3(userId + ":" + itemId); // cheap, non-crypto
}

List<Item> fetchFromSource(Source s) {
  HttpClient client = HttpClient.newHttpClient(); // per call
  return client.send(...);
}

private final HttpClient http = HttpClient.newBuilder()
  .connectTimeout(Duration.ofSeconds(2))
  .build();

List<Item> fetchFromSource(Source s) {
  return http.send(...);
}

HttpResponse<String> res = http.send(req, BodyHandlers.ofString());

HttpResponse<String> res = http.send(req, BodyHandlers.fromLineSubscriber(
    new BoundedStringSubscriber(MAX_BODY_BYTES)));
// or read with InputStream and abort when count > MAX

15Security & authorization

Document doc = db.findById(id);
return doc; // no owner check

Document doc = db.findById(id);
requireOwner(req.getUserId(), doc);
return doc;

db.query("SELECT * FROM docs WHERE id = '" + id + "'");

db.query("SELECT * FROM docs WHERE id = ?", id);

db.update(id, body);
if (!owns(req, id)) return 403;

Document doc = db.findById(id);
requireOwner(req.getUserId(), doc);
db.update(id, body);

static final String SESSION_SECRET = "super-secret-value";
static final String ANTHROPIC_KEY = "sk-ant-...";

String secret = Objects.requireNonNull(System.getenv("SESSION_SECRET"), "SESSION_SECRET");

log.info("incoming {}", req.getHeader("authorization"));

log.info("incoming user={} path={}", req.getUserId(), req.getPath());

int limit = Integer.parseInt(params.get("limit"));

int limit = parseLimit(params.get("limit"), /*default*/20, /*max*/100);

16Webhooks, payments & reliability

Event event = parse(body);
charge(event); // signature ignored

if (!verifyWebhookSignature(body, signatureHeader)) {
  return 401;
}
Event event = parse(body);
handle(event);

// type parsed then ignored
chargeCustomer(event);

switch (event.getType()) {
  case "payment_intent.succeeded" -> settle(event);
  default -> { /* 200-ack and ignore */ }
}

charge(event); // every delivery

if (db.events.wasProcessed(event.getId())) return true;
charge(event, /*idempotencyKey*/ event.getId());
db.events.markProcessed(event.getId());

Order order = db.orders.findById(event.orderId);
charge(order.getCustomerId(), order.getAmountCents());

Order order = db.orders.findById(event.orderId);
if (order == null) {
  log.warn("unknown order {}", event.orderId);
  return true; // ack — don't infinite-retry
}

try { db.markPaid(orderId); }
catch (Exception e) { log.error(e); }
sendReceipt(order);
return true;

db.markPaid(orderId); // let failure fail the webhook for retry/reconcile
sendReceiptBestEffort(order);
return true;

charge();
sendReceipt(); // throws → webhook fails → provider retries → charge again

charge();
markPaid();
try { sendReceipt(); } catch (Exception e) { log.warn("receipt", e); }

for (int i = 0; i < 5; i++) {
  try { return http.send(req); }
  catch (Exception e) { last = e; }
}
throw new RuntimeException("payment failed");

HttpRequest req = HttpRequest.newBuilder(uri).timeout(Duration.ofSeconds(5)).build();
for (int i = 0; i < 5; i++) {
  try {
    HttpResponse<String> res = http.send(req, BodyHandlers.ofString());
    if (res.statusCode() < 500 && res.statusCode() != 429) {
      if (res.statusCode() >= 400) throw new NonRetryable(res);
      return res;
    }
  } catch (NonRetryable e) { throw e; }
  catch (Exception e) { last = e; sleepWithJitter(i); }
}
throw new RuntimeException("payment failed", last);

17SDK & cache design

public Map<String, Boolean> cache = new HashMap<>();

private final Map<String, Boolean> cache = new ConcurrentHashMap<>();
// expose getFlag / invalidate only

if (now - fetchedAt < ttlMs) refresh(); // backwards

if (now - fetchedAt > ttlMs) refresh();

for (var e : remote.entrySet()) cache.put(e.getKey(), e.getValue());

Map<String, Boolean> next = remote.fetchAll();
cache.keySet().retainAll(next.keySet());
cache.putAll(next);

try { refresh(); } catch (Exception e) { /* empty */ }

try { refresh(); }
catch (IOException | JsonException e) {
  log.error("flag refresh failed", e);
}

getFlag("checkout_v2", false, true);

getFlag("checkout_v2", FlagOptions.defaults()
  .defaultValue(false)
  .refreshIfStale(true));

boolean getFlag(String k, boolean d) { ... return d; }
JsonNode getConfig(String k) { if (missing) throw ...; }

// Same absence policy on both — e.g. both Optional or both defaulted
Optional<Boolean> getFlag(String k);
Optional<JsonNode> getConfig(String k);

18Agent loops & tool safety

while (true) {
  Message m = model.complete(history);
  if (m.toolCalls.isEmpty()) break;
  history.addAll(execute(m.toolCalls));
}

for (int turn = 0; turn < MAX_TURNS; turn++) {
  Message m = model.complete(history);
  if (m.toolCalls.isEmpty()) return m;
  history.addAll(execute(m.toolCalls));
}
return gaveUpAfter(MAX_TURNS);

List<Result> results = executeFiltered(calls);
for (int i = 0; i < calls.size(); i++) {
  attach(calls.get(i).id, results.get(i)); // drifts after filter
}

Map<String, Result> byId = executeReturningIds(calls);
for (ToolCall c : calls) {
  attach(c.id, byId.get(c.id));
}

messages.add(0, userMessage(systemPrompt));

client.complete(SystemParam.of(systemPrompt), messages);

Path p = Paths.get(workspaceRoot(), inputPath);
Files.readString(p);

Path root = Path.of(workspaceRoot()).toRealPath();
Path p = root.resolve(inputPath).normalize().toRealPath();
if (!p.startsWith(root)) throw new SecurityException("path escapes workspace");

new ProcessBuilder("/bin/sh", "-c", modelCommand).start();

// Run inside locked-down sandbox + allowlist / approval gate
sandbox.runAllowlisted(modelCommand);

return Files.readString(path); // entire file into context

String out = Files.readString(path);
if (out.length() > MAX) return out.substring(0, MAX) + "\n…[truncated]";
return out;

String runOne(ToolCall call) {
  try {
    return HANDLERS.get(call.name).run(call.input);
  } catch (Exception e) {
    return ""; // model sees "nothing happened"
  }
}

String runOne(ToolCall call) {
  try {
    return HANDLERS.get(call.name).run(call.input);
  } catch (Exception e) {
    log.warn("tool {} failed: {}", call.name, e.toString());
    return "Error: " + e.getMessage(); // model can recover
  }
}

@Tool
Order search(String userId, String query) { // userId from model
  return db.find(userId, query);
}

Order search(AuthUser user, SearchArgs args) { // user from session
  return db.find(user.id(), args.query());
}

history.add(userMessage(downloadedPageHtml)); // treated as instructions
runWhateverToolsTheModelAsks();

history.add(toolResult(sanitize(downloadedPageHtml))); // data, not commands
if (isIrreversible(tool)) requireHumanApproval(tool);
validateArgs(schema, tool.args); // allowlist + types

19Google review standard & Java hygiene

User find(String id) { return map.get(id); } // null = miss

Optional<User> find(String id) { return Optional.ofNullable(map.get(id)); }

try { return parse(json); }
catch (Exception e) { return null; }

try { return parse(json); }
catch (JsonProcessingException e) {
  throw new InvalidPayload("order json", e);
}

InputStream in = Files.newInputStream(path);
return new String(in.readAllBytes()); // leak on exception paths

try (InputStream in = Files.newInputStream(path)) {
  return new String(in.readAllBytes());
}

20Java depth interviewers expect at staff

class UserId {
  int id;
  public boolean equals(Object o) { return id == ((UserId) o).id; }
  // missing hashCode — HashMap breaks
}

record UserId(int id) {} // equals/hashCode correct; immutable

public List<Item> items() { return items; } // mutable escape

public List<Item> items() { return List.copyOf(items); }

} catch (InterruptedException e) {
  // ignore
}

} catch (InterruptedException e) {
  Thread.currentThread().interrupt();
  throw e; // or break out of the worker loop
}

21Spring Boot review checklist

# BROKEN for prod
management.endpoints.web.exposure.include=*

management.endpoints.web.exposure.include=health,info,prometheus
management.server.port=8081
# + SecurityFilterChain requiring ADMIN on /actuator/**

@PostMapping("/orders")
Order create(@RequestBody Order entity) { // no @Valid, persistence type at edge
  return repo.save(entity);
}

@PostMapping("/orders")
OrderResponse create(@Valid @RequestBody CreateOrderRequest req) {
  return service.create(req);
}

@Value("${feed.upstream.timeout-ms}") long timeout;

@ConfigurationProperties(prefix = "feed.upstream")
public record UpstreamProps(@Min(1) long timeoutMs, @NotBlank String baseUrl) {}

22Spring Boot — extra staff checks

@Transactional
void checkout(Order o) {
  repo.save(o);
  payments.charge(o); // remote call inside TX
  mail.send(o);
}

@Transactional
void checkout(Order o) {
  repo.save(o);
  outbox.enqueue(OrderPaid.of(o));
}
// separate processor: charge + mail with idempotency

return repo.findById(id); // entity graph escapes to Jackson

return repo.findSummaryById(id); // DTO/projection

@PreAuthorize("isAuthenticated()")
Document get(Long id) { return repo.findById(id).orElseThrow(); }

@PreAuthorize("@docs.owner(authentication, #id)")
Document get(Long id) { return repo.findById(id).orElseThrow(); }

23Java & Spring Boot review bible — how to use this

24Spring Security bible (with samples)

http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/public/**").permitAll()
    .anyRequest().permitAll()); // BLOCKER

http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/actuator/health", "/actuator/info").permitAll()
    .requestMatchers("/api/public/**").permitAll()
    .anyRequest().authenticated());

@PatchMapping("/users/{id}")
User update(@PathVariable long id, @RequestBody User body) {
  // client can set body.role = "ADMIN"
  return repo.save(body);
}

@PatchMapping("/users/{id}")
UserResponse update(@PathVariable long id, @Valid @RequestBody UpdateUserRequest req) {
  return service.updateProfile(id, req.name(), req.email()); // no role field
}

http.csrf(csrf -> csrf.disable()); // with cookie session — BLOCKER

// Cookie session: keep CSRF (or CookieCsrfTokenRepository)
// Bearer-only API: csrf.disable() OK if no cookie session auth
http.csrf(csrf -> csrf.disable())
    .sessionManagement(s -> s.sessionCreationPolicy(STATELESS));

Jwts.parserBuilder().build()
  .parseClaimsJws(token); // weak — no key/alg/iss discipline

Jwts.parserBuilder()
  .requireIssuer("https://auth.example")
  .requireAudience("orders-api")
  .setSigningKey(publicKey) // asymmetric; reject alg none
  .build()
  .parseClaimsJws(token);

log.info("auth={}", request.getHeader("Authorization"));
log.info("user={}", user); // may dump password hash / PII

log.info("userId={} path={}", userId, path);
// structured logger with field denylist for authorization, password, pan

config.addAllowedOriginPattern("*");
config.setAllowCredentials(true);

config.setAllowedOrigins(List.of("https://app.example.com"));
config.setAllowCredentials(true);
config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));

25Spring Data / JPA bible (with samples)

@GetMapping("/orders")
List<Order> list() {
  return repo.findAll(); // BLOCKER at scale
}

@GetMapping("/orders")
Page<OrderSummary> list(@PageableDefault(size = 20) Pageable pageable) {
  Pageable safe = PageRequest.of(
      pageable.getPageNumber(),
      Math.min(pageable.getPageSize(), 100),
      pageable.getSort());
  return repo.findSummaries(safe);
}

List<Order> orders = repo.findAll();
for (Order o : orders) {
  o.getLines().size(); // N+1
}

@Query("select o from Order o join fetch o.lines where o.customerId = :id")
List<Order> findWithLines(long id);
// or projection interface / DTO constructor expression

@Transactional
public Order get(long id) { return repo.findById(id).orElseThrow(); }

@Transactional(readOnly = true)
public Order get(long id) { return repo.findById(id).orElseThrow(); }

account.setBalance(account.getBalance() - amount);
repo.save(account); // lost update under concurrency

@Entity
class Account {
  @Version long version;
  // …
}
// or: update account set balance = balance - :amt where id = :id and balance >= :amt

26Network & HTTP clients bible (with samples)

WebClient.create(baseUrl)
  .get().uri("/x").retrieve().bodyToMono(String.class)
  .block(); // no timeouts

HttpClient netty = HttpClient.create()
  .option(ChannelOption.CONNECT_TIMEOUT_MILLIS, 2000)
  .responseTimeout(Duration.ofSeconds(5));
WebClient client = WebClient.builder()
  .clientConnector(new ReactorClientHttpConnector(netty))
  .baseUrl(baseUrl)
  .build();

return new RestTemplate(); // infinite wait risk

RestTemplate rt = new RestTemplateBuilder()
  .setConnectTimeout(Duration.ofSeconds(2))
  .setReadTimeout(Duration.ofSeconds(5))
  .build();

for (int i = 0; i < 5; i++) {
  rest.postForEntity(url, chargeRequest, Void.class); // duplicate money
}

@Retry(name = "payments", ignoreExceptions = HttpClientErrorException.class)
@CircuitBreaker(name = "payments")
public void charge(IdempotentCharge req) {
  client.post(req); // Idempotency-Key header required
}

String url = request.getUrl(); // user controlled
return webClient.get().uri(url).retrieve().bodyToMono(String.class);

URI uri = URI.create(request.getUrl());
if (!ALLOWED_HOSTS.contains(uri.getHost())) {
  throw new BadRequest("host not allowed");
}
return webClient.get().uri(uri).retrieve().bodyToMono(String.class);

webClient.get().uri("/deps/x").retrieve()...

webClient.get()
  .uri("/deps/x")
  .header("traceparent", TraceContext.current())
  .header("X-Request-Id", MDC.get("cid"))
  .retrieve()...

sslContext.init(null, trustAllCerts, new SecureRandom()); // BLOCKER

// Use platform trust store / pinned certs; never trust-all in shared modules

27Async & Kafka bible (with samples)

@KafkaListener(topics = "orders")
void onMessage(OrderEvent e) {
  billing.charge(e); // if this throws forever, partition stalls / dupes depending on config
}

@KafkaListener(topics = "orders")
void onMessage(OrderEvent e, Acknowledgment ack) {
  billing.chargeIdempotent(e);
  ack.acknowledge();
}
// Container factory: DefaultErrorHandler with DeadLetterPublishingRecoverer + fixed backoffs

void onMessage(OrderEvent e) {
  repo.save(Order.from(e)); // duplicate insert on redelivery
}

void onMessage(OrderEvent e) {
  if (!processed.markIfNew(e.eventId())) return;
  repo.upsert(Order.from(e));
}

@Transactional
void place(Order o) {
  orderRepo.save(o);
  kafka.send("orders", OrderCreated.of(o)); // dual-write
}

@Transactional
void place(Order o) {
  orderRepo.save(o);
  outboxRepo.save(OutboxMessage.of("orders", OrderCreated.of(o)));
}
// @Scheduled / Debezium publisher drains outbox

spring.kafka.producer.acks=1
# enable.idempotence unset

spring.kafka.producer.acks=all
spring.kafka.producer.properties.enable.idempotence=true
spring.kafka.producer.properties.min.insync.replicas=2

@EnableAsync
// no AsyncConfigurer — unbounded growth risk

@Bean
TaskExecutor appExecutor() {
  ThreadPoolTaskExecutor ex = new ThreadPoolTaskExecutor();
  ex.setCorePoolSize(8);
  ex.setMaxPoolSize(16);
  ex.setQueueCapacity(500);
  ex.setRejectedExecutionHandler(new CallerRunsPolicy());
  ex.initialize();
  return ex;
}

@Transactional
void settle(Order o) {
  repo.markPaid(o.id());
  kafka.send(...);
  http.notifyPartner(...); // still in TX
}

@Transactional
void settle(Order o) {
  repo.markPaid(o.id());
  outbox.save(...);
}
// after commit: publisher + async notify with idempotency

28Spring API & observability bible (with samples)

@PostMapping
Order create(@RequestBody Order o) { return service.create(o); }

@PostMapping
ResponseEntity<OrderResponse> create(@Valid @RequestBody CreateOrderRequest req) {
  return ResponseEntity.status(201).body(service.create(req));
}
@ExceptionHandler
ProblemDetail onValidation(MethodArgumentNotValidException ex) { ... }

@PostMapping("/charges")
ChargeResponse charge(@RequestBody ChargeRequest req) {
  return payments.charge(req);
}

@PostMapping("/charges")
ChargeResponse charge(
    @RequestHeader("Idempotency-Key") String key,
    @Valid @RequestBody ChargeRequest req) {
  return payments.chargeOnce(key, req);
}

partnerClient.fetch(id);

return Timer.builder("http.client.partner")
  .tag("method", "GET")
  .register(meterRegistry)
  .record(() -> partnerClient.fetch(id));

29Microservice & distributed-systems review

RestClient.get().uri(url).retrieve().body(String.class); // default may block too long

RestClient.builder()
  .requestFactory(factoryWithConnectAndReadTimeouts(200, 800))
  .build();

for (int i = 0; i < 3; i++) {
  payments.charge(orderId, amount); // duplicate charge on retry
}

payments.charge(orderId, amount, IdempotencyKey.of(requestId));

// each hop retries independently with full budget

Duration budget = remainingDeadline(ctx);
callDownstream(ctx.withDeadline(budget.minus(safetyMargin)));

30Microservices — extra staff checks

log.info("paid order {}", orderId); // no request id

log.info("paid order {} correlationId={}", orderId, MDC.get("cid"));
// HTTP: outgoing header; Kafka: headers.add("cid", ...)

executor = new ThreadPoolExecutor(..., new LinkedBlockingQueue<>()); // unbounded

executor = new ThreadPoolExecutor(
  n, n, 60, SECONDS, new ArrayBlockingQueue<>(1000),
  new ThreadPoolExecutor.AbortPolicy());

docs.get(docId); // uses god-mode service account

docs.get(docId, TenantContext.required()); // enforced downstream

31Kafka producer & consumer review

props.put("acks", "1");
props.put("retries", 5);
// enable.idempotence unset / false → duplicate risk

props.put("enable.idempotence", "true"); // forces acks=all, safe retries
props.put("acks", "all");

consumer.poll(timeout);
for (record : records) {
  // auto-commit may already have advanced
  db.save(record);
}

consumer.poll(timeout);
for (record : records) {
  db.saveIdempotent(record); // upsert / dedupe by event id
}
consumer.commitSync();

# topic RF=3 but min.insync.replicas left at 1

# broker/topic
min.insync.replicas=2
# producer acks=all

while (true) {
  process(record); // throws forever — partition stuck
}

try {
  process(record);
} catch (Exception e) {
  if (attemptsExhausted(record)) {
    dlq.publish(record, e);
  } else throw e; // retry / seek policy
}
commit(record);

32Kafka — extra staff checks

repo.save(order);
producer.send(OrderCreated.of(order)); // crash → lost event or ghost event

@Transactional
void place(Order order) {
  repo.save(order);
  outbox.save(OrderCreated.of(order));
}

for (record : records) {
  Thread.sleep(120_000); // exceeds max.poll.interval → rebalance storm
  process(record);
}

for (record : records) {
  processIdempotent(record); // fast or async with careful commit
}
consumer.commitSync();

// treating compacted changelog as a task queue

// task queue: delete retention + consumer groups
// latest-state per key: compact + tombstones

33Practice drills (crack the round)

1. Drill A (20 min) — Checkout: Hunt double money, coupon ==, null vs throw, god checkout(), dead params. Target ≥3 blockers/highs.
2. Drill B (20 min) — Redis lock worker: NX PX, token-safe release, busy-spin, interrupt, DLQ. Target all five.
3. Drill C (25 min) — Feed/cache: Sequential fanout, unbounded batch, region in key, TTL/LRU, single-flight, HttpClient reuse, body cap, PBKDF2 scorer.
4. Drill D (20 min) — Documents API: IDOR on get/update/delete, SQLi, secrets, pagination clamp, shared requireOwner.
5. Drill E (25 min) — Webhook + Kafka: Signature verify, event type, idempotency, markPaid, receipt off path; producer idempotence + process-then-commit.
6. Drill F (25 min) — Agent loop: Iteration budget, result-by-id, path traversal, shell sandbox, empty error string, model-supplied userId.
7. Drill G (15 min) — Closing muscle: From any prior drill, deliver only the 60-second ranked summary aloud.
8. Drill H (30 min) — Spring PR bible: SecurityFilterChain + IDOR, @Transactional around HTTP, WebClient timeouts, @KafkaListener ack/DLQ, Idempotency-Key on POST. Write a ranked review with ≥4 blockers/highs.

34Low-signal comments — with snippets

if (signature == null || signature.isEmpty()) {
  return false;
}

// Real finding — wire verification before charge
if (!verifyWebhookSignature(rawBody, signatureHeader)) {
  return 401;
}
handle(parse(rawBody));

Mac mac = Mac.getInstance("HmacSHA256");
boolean ok = MessageDigest.isEqual(mac.doFinal(body), sig);
// …but handleWebhook never calls this helper
void handleWebhook(byte[] body) {
  Event e = parse(body);
  charge(e); // unsigned body trusted
}

if (!verifyWebhookSignature(body, header)) return 401;
charge(parse(body));

for (byte b : digest) {
  sb.append(String.format("%02x", b));
}

void handle(HttpExchange exchange) throws IOException {
  InputStream in = exchange.getRequestBody();
  byte[] body = in.readAllBytes();
  // …
}

Event e = new Event();
e.id = json.substring(json.indexOf(""id":") + 5); // fragile parse
charge(e); // no signature check, no dedupe on e.id

if (!verify(body, sig)) return 401;
Event e = mapper.readValue(body, Event.class);
if (db.wasProcessed(e.id)) return 200;
charge(e);
db.markProcessed(e.id);

String findTopProduct(Map<String, Long> counts) {
  String best = null;
  long bestCount = -1;
  for (var e : counts.entrySet()) { // HashMap — arbitrary order
    if (e.getValue() > bestCount) {
      best = e.getKey();
      bestCount = e.getValue();
    }
  }
  return best; // ties → nondeterministic winner
}

return counts.entrySet().stream()
  .max(Comparator.comparingLong(Map.Entry<String, Long>::getValue)
      .thenComparing(Map.Entry::getKey))
  .map(Map.Entry::getKey)
  .orElse(null);

List<Item> getCached(String key) {
  return map.get(key); // null = miss
}
Feed getOrLoad(String key) {
  List<Item> hit = getCached(key);
  if (hit == null) {
    hit = loader.load(key);
    map.put(key, hit);
  }
  return new Feed(hit);
}

Optional<List<Item>> getCached(String key) {
  return Optional.ofNullable(map.get(key));
}
Feed getOrLoad(String key) {
  return new Feed(getCached(key).orElseGet(() -> loadAndStore(key)));
}

Feed buildFeed(String userId, String region) {
  List<Item> all = new ArrayList<>();
  for (Source s : sourcesFor(userId)) {
    HttpClient c = HttpClient.newHttpClient(); // per call
    all.addAll(fetch(c, s, region)); // sequential
  }
  // getOrLoad has no single-flight — stampede on cold key
  return rank(all);
}

List<Source> all = db.findAllSources(); // fair note, lower priority
List<Source> followed = all.stream().filter(s -> follows.contains(s.id)).toList();
for (Source s : followed) fetch(s); // sequential + per-call client + forever cache above

35Staff scorecard (use before you submit / leave the room)

• Did I name at least one way this loses money, leaks data, dual-runs work, or OOMs / stampedes under load?
• Did I propose a fix shape (atomic op, shared guard, pure function, single-flight, bounded pool)?
• Did I separate blocker / high / nit?
• Did I ask one clarifying question where intent might be unfinished?
• Did I deliver a 60-second ranked summary?
• Would an interviewer see judgment separating production risks from background noise?

36Practice next