Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap

Roadmap

Twelve milestones have shipped since the foundations. The latest published release on Maven Central is 00.79.41:

  • 00.51.00 (2026-05-08) — the multi-module split (security-core / security-vaadin / security-rest), the REST adapter, the two-tier demo-vaadin-rest-client, the first-run bootstrap and the central LogoutService.
  • 00.60.00 (2026-05-14) — all eight Konzept-V00.60 points as stable SPIs: audit, brute-force, session policy, action authorization, logout, bootstrap, plus the jSentinel-standalone adapter.
  • 00.70.00 (2026-05-31) · details — all eight Konzept-V00.70 phases: multi-tenancy, 11 persistence-store SPIs with an Eclipse-Store reference, JSentinelVersion drift detection, the Policy API
    • @Secured method-security processor, role hierarchy, account lifecycle, API keys, rate limiting, and the Phase-8 Vaadin component layer.
  • 00.71.00 · details — the credential-security stack: pluggable hashing (Argon2id / bcrypt / scrypt), post-KDF pepper, CredentialStore, atomic password change, single-use reset, breached-password checks, abuse detection, ASVS / NIST / CWE traceability. Ships in the 00.72 line.
  • 00.72.00 (2026-06-08) · details — the developer-experience release: typed fluent bootstrap, @JSentinelAutoService, the Vaadin starter, and secret-free diagnostics. 22 modules.
  • 00.73.00 (2026-06-10) · details — fluent-bootstrap completion + the jSentinel rebrand. The recorded-only sub-builders (.audit / .sessions / .policies / .roles / .credentials) now wire through, the wrapper-index writer ships, and SecuredUi / @SecureRoute become policy-aware. Plus a breaking move of all coordinates, packages and Security* types to the jSentinel namespace, and three STRICT-mode promotions.
  • 00.74.00 + 00.74.10 + 00.74.20 (2026-06) · details — declarative token propagation (@PropagateToken, TokenCredentialStore, pass-through / token-exchange / client-credentials, three new jSentinel-propagation* modules), plus the 00.74.10 JSentinelRuntime tooling API (healthCheck / toJson) and the 00.74.20 Storage-Pair (JSentinelStorageFactory / JSentinelStoragePair — framework + app Eclipse-Store under one parent dir, two-phase shutdown).
  • 00.75.00 (2026-06-24) · details — the Security Event Bus: ~34 typed JSentinelEvent records in signed (Ed25519) envelopes with replay protection, per-(tenant, producer) sequencing, producer policy, Eclipse-Store-backed stores and a REST/SSE bridge. Audit becomes a consumer of the bus. Four new modules; purely additive. Hardened by two production-review ticks — 00.75.10 (type-safe TokenHasher, a SpotBugs/FindSecBugs gate, urgent event-bus / Eclipse-Store fixes) and 00.75.20 (39 review findings: secret-leak redaction, concurrency races, fail-closed @SecureRoute, OWASP-minimum KDF floors).
  • 00.76.00 (2026-06-25) · details — standardized JWT validation: a new opt-in jSentinel-jwt module (Nimbus) with a JOSE-free JwtValidator SPI in the core, a disciplined JWKS client, a mandatory algorithm allow-list with hard algorithm-confusion defence (alg:none, HMAC-with-asymmetric-key, family mismatch all rejected), and a .jwt(...) bootstrap across all three adapters. The crypto base for the OAuth2 / OIDC arc; additive. Hardened by 00.76.10 — a full security review of all 25 library modules (14 findings fixed in-cycle), a reactor-wide SpotBugs / FindSecBugs gate, and all 46 Dependabot alerts closed.
  • 00.77.00 (2026-06-26) · details — OAuth2 Relying-Party flows: Authorization-Code + PKCE (S256-only), client authentication incl. private_key_jwt, refresh-token rotation with reuse-detection (revokes the family), introspection, revocation and the Device Authorization Grant — wired through .oauth2(...). Adds JWT signing (JwtSigner). Three new modules on the jSentinel-jwt base; additive.
  • 00.78.00 (2026-06-27) · details — OpenID Connect Relying-Party: ID-token validation (nonce / azp / at_hash / acr step-up), discovery, UserInfo, RP-initiated logout and claims-to-subject mapping — wired through .oidc(...). Three new modules.
  • 00.79.00 (2026-06-27) · details — Identity Interop + Stable-API (Etappe 1): the coordinated stable-API promotion of the JWT / OAuth2 / OIDC surfaces (47 types lose @ExperimentalJSentinelApi), six IdP vendor profiles (Keycloak, Entra, Auth0, Okta, Google, GitHub) and a no-mock OIDC test harness. Completed by 00.79.10 (replay-stores, DPoP / RFC 9449, OIDC back-/front-channel logout) and 00.79.20 (JWE, mTLS, PAR, JAR, FIPS) — with which the 00.76 → 00.79 identity trilogy is feature-complete. Followed by three security-hardening ticks (60 findings closed total, no new module): 00.79.30 (28 findings — secure-by-default session rotation, fail-closed empty-constraint evaluators, JWT/OIDC/DPoP spec-fidelity fixes), 00.79.40 (10 findings plus opt-in deny-by-default authorization), and 00.79.41 (21 findings — GitHub identity hardening, the OIDC nonce/CSRF fix, annotation inheritance, three new anti-drift shared homes).

Planned

The path from the released 00.79 line to the high-security 00.80 milestone — each a concept on develop, not yet released:

  • v00.80.00 — High-security & operations: MFA / step-up, WebAuthn / passkeys, tamper-evident audit, monitoring.

Delivered in 00.70.00

AreaWhat shipped
Multi-tenancyTenantId / ResourceRef / ResourceAccessContext; every store key and service tenant-scoped. See Multi-Tenancy.
Persistence11 store SPIs + in-memory defaults + Eclipse-Store reference + contract testkit. See Persistence.
Active sessionsJSentinelVersion drift detection, role refresh for live sessions, store-backed SubjectSessionRegistry, SessionManagementView.
Method security@Secured compile-time processor + runtime SecuredProxy.wrap(...), one JSentinelEnforcer. See Method Security.
Policy API@RequiresPolicy, PolicyRegistry, sealed PolicyDecision. See Policy API.
Authorization ergonomicsRoleHierarchy SPI, @RequiresAnyPermission, @RequiresAllPermissions.
Account lifecyclePassword reset, email verification, JSentinelNotificationSender SPI.
Tokens + rate limitingAPI keys, rotating refresh tokens, sliding-window RateLimitPolicy.
Audit27 sealed AuditEvent variants (11 new), StoreBackedSecurityAuditService.

Delivered in 00.60.00

#CapabilityNotes
1Password hashingPasswordHasher + PasswordHash (typed record) + Pbkdf2PasswordHasher (PBKDF2-HMAC-SHA256, 120 000 iter). needsRehash(...) drift detection; both demo stores rehash transparently on successful login.
2Security audit pipelineJSentinelAuditService SPI with 16 sealed AuditEvent record types (incl. UserCreated/UserDeleted from the new admin UI). RingBufferAuditSink + LoggingAuditSink + CompositeAuditService. Vaadin /audit route + REST GET /api/audit. See Security Audit.
3Brute-force protectionLoginAttemptPolicy SPI with sealed LoginAttemptDecision = Allowed | LockedOut. InMemoryLoginAttemptPolicy default. Red lockout banner in both Vaadin demo login views; 429 + Retry-After in REST. See Brute-Force Protection.
4Session policiesSessionPolicy<U> SPI with TimeoutSessionPolicy default. Session-id rotation honoured on login as session-fixation defence. See Session Policy.
5Role persistenceAuthorizationService stays the boundary; no RoleStore forced into core. Both Vaadin demos ship a /admin/roles UI with role assignment, user create + delete (with ConfirmDialog).
6Multi-session logoutLogoutService.logout(SubjectId, LogoutScope) with LogoutScope = CurrentSession | AllSessionsOfSubject. SubjectSessionRegistry tracks active sessions; LogoutListener lets adapters plug in cleanup. See Logout Flows.
7Action authorizationActionAuthorizationService<U> SPI (stable, not just static helpers). ActionPermission record, StaticActionAuthorizationService default. Every denial automatically emits an ActionDenied audit event.
8First-run bootstrapModes, token store (POSIX 0600), TTL parsing, race-safe admin creation, leak-free validation, brute-force-protected. See Bootstrap.

Plus, beyond the Konzept

CapabilityNotes
Core-Java adapterNew jSentinel-standalone module (3 classes: Secured, StandaloneLoginFlow, ThreadLocalSubjectStore). Same annotations enforce security on plain Java services via dynamic proxy — no Vaadin, no REST. New demo-standalone CLI demonstrates. See Standalone Integration.
JSentinelServiceResolverCentral SPI cache for all eight services. Strict accessors throw IllegalStateException; find…() returns Optional; set…(…) is a programmatic test seam.
Role + User admin UI in both Vaadin demos/admin/roles with single-role-set semantics; new-user dialog; per-row delete with ConfirmDialog. Backend-driven in demo-vaadin-rest-client over GET/POST/PUT/DELETE /api/admin/users.
Mutation-tested libraryPitest runs on all four library modules — 79 / 90 / 95 / 98 %. See Architecture → Quality.
Vaadin Browserless TestingWired in jSentinel-vaadin + both Vaadin demos. Real adapter-test suite covers LoginView policy ordering, action-gated UI patterns, B3 session-id rotation against MockHttpSession, lockout banner formatting, /audit grid filtering, /setup, /admin/roles flows, MainView tab matrix per role. Replaces the planned Karibu / TestBench setup — free since Vaadin 25.1.
~570 tests across all modulesReactor-wide mvn test.

Open within the 00.60 line

CapabilityWhy it matters
PermissionName graduationStill marked @ExperimentalSecurityApi. Konzept calls for stable status alongside the now-shipped ActionAuthorizationService SPI.
Demo mutation-coverage pushdemo-rest (49 %) and demo-vaadin-rest-client (10 %) trail the library numbers. Pitest run pending for the next iteration.

Delivered in 00.71.00 (Credential Hardening)

✅ Shipped on Maven Central as part of the 00.72.00 release line. Phases 1a–5 complete (35 of 36 prompts). Pull it in with 00.79.41 coordinates — see Quick Start.

v00.71.00 is a dedicated credential-security stack built against modern standards (OWASP ASVS V2, NIST SP 800-63B, CWE):

  • Pluggable hashing — JDK-only PBKDF2 core plus an optional jSentinel-crypto-bc module adding Argon2id / bcrypt / scrypt (BouncyCastle lightweight API, no global JCA mutation).
  • Post-KDF HMAC pepper with rotation, calibration profiles, Unicode-aware input hygiene, SecretValue (AutoCloseable).
  • CredentialStore with compare-and-swap updates, an eight-state lifecycle, atomic password change, single-use selector/verifier reset.
  • Abuse detection — multi-dimensional sliding-window (username / client-address / tenant / global), credential-stuffing and password-spraying detectors, context-aware password validation, optional password history.
  • Compromised-password check — CompromisedPasswordChecker SPI with an optional jSentinel-credentials-hibp module (Have I Been Pwned via k-anonymity SHA-1 prefix; plaintext never leaves the JVM).
  • Compliance traceability — ASVS / NIST / CWE coverage matrix.

Read more: v00.71.00 · Credential Hardening · Compliance & CWE Coverage · 00.71.00 release notes.

Delivered in 00.72.00 (Developer Experience)

✅ Latest release on Maven Central. All 35 V00.72 prompts shipped; the DX surface is marked @ExperimentalSecurityApi until V00.73 wiring follow-ups.

v00.72.00 is a deliberate stabilisation / adoption release — no new security primitives, no SPI replaced. It lowers the integration barrier with four building blocks:

  • Typed fluent bootstrap — VaadinSecurity.bootstrap() / RestSecurity.bootstrap() / StandaloneSecurity.bootstrap() configure every subsystem in one call path and return a diagnostic JSentinelRuntime; JSentinelBootstrapMode (COMMUNITY_DEFAULTS / DEVELOPMENT / PRODUCTION / STRICT).
  • @JSentinelAutoService — a dependency-free annotation + JDK-only processor that generates META-INF/services files (no external Google AutoService); a marker-comment protocol preserves hand-written entries.
  • jSentinel-vaadin-starter — declarative SecuredUi.button / link / menuItem, @SecureRoute(roles, permissions, policy), and development / production / strict profiles.
  • JSentinelDiagnostics.inspect() — secret-free report of active services, applied defaults, generated wrappers, and missing / duplicate / conflicting SPIs.

Reactor grows 16 → 22 modules; jSentinel-core is unchanged.

Read more: v00.72.00 · 00.72.00 release notes.

Planned — v00.80.00

Concept only — nothing below ships today. SPIs, module names, signatures, and scope may shift before they land.
v00.80.00 — Planned
High-security & identity integration. MFA / step-up, WebAuthn / Passkeys, OIDC-OAuth2 bridge, device + remember-me management, risk-based authentication, tamper-evident audit (hash-chaining), Security Event Bus, metrics + health, fail-closed strict mode, CSRF hardening, GDPR / retention / backup-restore.

Explicitly out of scope

  • Built-in cluster mode. The SPIs (SubjectSessionRegistry, JSentinelAuditService, LoginAttemptPolicy) are deliberately shaped so Redis / database / IAM-backed implementations are drop-in replacements when needed.
  • security-javafx as a dedicated module. Both 00.70 and 00.80 concepts hold the line: jSentinel-standalone covers Swing / JavaFX / CLI functionally via manual SecuredProxy.wrap(...) + StandaloneLoginFlow. A JavaFX-specific module only makes sense once a real UI-lifecycle need surfaces.
  • Becoming a full IAM / OIDC stack. The 00.80 OIDC/OAuth2 bridge translates external identity into internal subjects; it does not replace established identity-provider clients.

License

EUPL 1.2