I will review your java or spring boot code for security vulnerabilities

Secure code review for Java and Spring Boot apps by a PhD researcher in Java static analysis. Before a launch, an audit or a client handover, find the real security holes (OWASP Top 10: injection, broken access control, auth and session flaws) and get fixes your team can act on, not a 200-page scanner dump.

What I do:

1. SAST with CodeQL and Semgrep, tuned to your code to cut false alarms.
2. 2. Manual data-flow review of risky paths: login and sessions, access control, and every place user input reaches SQL, files, templates or shell commands, plus vulnerable dependencies.
3. 3. A report: each real finding with severity, exact lines, how it could be exploited, and the fix.

Why me: I work on Doop, a Java points-to and taint analysis framework, with papers at OOPSLA 2025, PLDI 2020 (Java enterprise apps: Spring, Hibernate) and ECOOP 2020, and I worked at Oracle Labs on Java enterprise analysis. Large codebases are fine: I run analyses on HPC clusters.

I sign NDAs and your code stays private. Tell me where the code lives and roughly how many lines it has.