# jSentinel (jSentinel)

> jSentinel — security for Java software: EUPL-licensed open-source security libraries, security & AI-security consulting, and developer training. Independently built in the EU.

jSentinel is an independent, EU-based company: open-source Java security, security & AI-security consulting, building AI systems secure by design (jSentinel AI — AI advisory, AI apps, corporate/private LLMs, RAG systems, personal AI assistants), and developer training. Its flagship open-source library, **jSentinel for Java**, is a framework-neutral security core (authentication, authorization, audit, brute-force protection, session policy, multi-tenancy, method security, Policy API, store-agnostic persistence) wired through Java SPI — Java 26, EUPL 1.2. Latest release on Maven Central: 00.79.41 under `com.svenruppert.jsentinel` with `jSentinel-*` artifacts (the earlier 00.72.00 line shipped as `com.svenruppert:security-*`).

## Start here
- [Why jSentinel](https://sec.svenruppert.com/why/): Why choose jSentinel for Java — a framework-neutral, mutation-tested security library compared honestly with Spring Security, an external IdP like Keycloak, and rolling your own. Where it fits, and where it doesn't (yet).
- [jSentinel for Java](https://sec.svenruppert.com/open-source/jsentinel-for-java/): the flagship open-source library — overview, then dive into the docs.

## Documentation
- [Quick Start](https://sec.svenruppert.com/docs/quick-start/): Build jSentinel and run the four reference demos — Vaadin in-JVM, REST + CLI, two-tier Vaadin+REST, and a standalone Core-Java CLI. Maven coordinates for jSentinel-vaadin, jSentinel-rest, jSentinel-standalone (00.79.41).
- [Vaadin Integration](https://sec.svenruppert.com/docs/vaadin-integration/): jSentinel Vaadin integration — secure Vaadin Flow views with @RequiresRole / @RequiresPermission annotations, SPI-based AuthenticationService / AuthorizationService, navigation-decision mapper. Compatible with Vaadin 25.1+.
- [Claude Code Skills](https://sec.svenruppert.com/docs/skills/): Ten Claude Code skills that integrate jSentinel into a Vaadin, REST or Standalone Java app from a single prompt — base integration plus persistence and hardening layers, and a Vaadin↔REST hybrid. Download, install into ~/.claude/skills, and ask.
- [Standalone Integration](https://sec.svenruppert.com/docs/standalone-integration/): jSentinel Standalone integration — secure plain Java services, CLI tools, desktop and batch apps with SecuredProxy.wrap() dynamic proxy. Same @RequiresRole / @RequiresPermission annotations as Vaadin / REST. ThreadLocalSubjectStore + StandaloneLoginFlow.
- [REST Integration](https://sec.svenruppert.com/docs/rest-integration/): jSentinel REST integration — secure JDK HttpServer or any servlet endpoint with RestSubjectResolver, @RequiresRole / @RequiresPermission annotations, RestAuthorizationFilter, BearerTokenExtractor. No Spring, no Jakarta Security.
- [Method Security](https://sec.svenruppert.com/docs/method-security/): Enforce @RequiresRole / @RequiresPermission / @RequiresPolicy on plain Java methods — a compile-time annotation processor generates <Type>Secured wrappers, the runtime SecuredProxy.wrap(...) covers interfaces, both route through one JSentinelEnforcer.
- [Policy API](https://sec.svenruppert.com/docs/policy-api/): Express authorization decisions that go beyond plain role or permission checks — a typesafe Java builder, PolicyRegistry, sealed PolicyDecision (Allowed / Denied / StepUpRequired), @RequiresPolicy annotation, and resource-aware evaluation via ResourceRef.
- [Multi-Tenancy](https://sec.svenruppert.com/docs/multi-tenancy/): Tenant-ready security without forcing a tenant-admin model — TenantId with DEFAULT, tenant-scoped store keys and records, ResourceRef, and JSentinelVersion drift detection that refreshes roles for active sessions per tenant.
- [Persistence](https://sec.svenruppert.com/docs/persistence/): Store-agnostic persistence for jSentinel — 11 small store SPIs in jSentinel-core with in-memory defaults, an Eclipse Store reference module, store-backed services, and a contract testkit every store adapter must pass. No database lock-in, no Eclipse-Store dependency in the core.
- [Credential Hardening](https://sec.svenruppert.com/docs/credential-hardening/): jSentinel's credential-security stack (v00.71 preview) — JDK-only PBKDF2 core, optional Argon2id / bcrypt / scrypt via BouncyCastle, post-KDF HMAC pepper with rotation, compare-and-swap CredentialStore, atomic password change, single-use reset, breached-password checks via Have I Been Pwned, abuse detection.
- [Architecture](https://sec.svenruppert.com/docs/architecture/): jSentinel architecture — 13 Maven modules, package layout, sealed decision model (AuthorizationDecision, PolicyDecision, JSentinelVersionStatus, RateLimitDecision), JSentinelServiceResolver SPI registry, 11 persistence-store SPIs, reusable building blocks, mutation coverage.
- [API Reference](https://sec.svenruppert.com/docs/api-reference/): Browsable Javadoc API reference for the published jSentinel for Java 00.74.00 library modules — jSentinel-core and the Vaadin, REST and Standalone adapters. Reskinned to the jSentinel theme, served same-origin.
- [Bootstrap](https://sec.svenruppert.com/docs/bootstrap/): jSentinel bootstrap — first-run mechanism for creating the initial administrator account. POSIX-0600 token files, TTL, race-safe creation, fail-fast on misconfiguration, REST + CLI + Vaadin /setup flows.
- [Logout Flows](https://sec.svenruppert.com/docs/logout/): jSentinel logout flows — LogoutService.logout(SubjectId, LogoutScope) with CurrentSession vs AllSessionsOfSubject. VaadinLogoutService handles VaadinSession + HttpSession + browser redirect; SubjectSessionRegistry tracks active sessions.
- [Security Audit](https://sec.svenruppert.com/docs/audit/): jSentinel Security Audit — typed publish/query pipeline with 27 sealed AuditEvent records, RingBufferAuditSink + LoggingAuditSink, StoreBackedSecurityAuditService, Vaadin /audit grid, REST GET /api/audit, automatic emission from every SPI.
- [Brute-Force Protection](https://sec.svenruppert.com/docs/brute-force/): jSentinel brute-force protection — LoginAttemptPolicy SPI with sealed LoginAttemptDecision (Allowed | LockedOut). Vaadin red lockout banner, REST 429 + Retry-After, progressive backoff defaults.
- [Session Policy](https://sec.svenruppert.com/docs/session-policy/): jSentinel SessionPolicy — idle timeout, absolute lifetime, session-id rotation after login as session-fixation defence (B3). Sealed SessionDecision + SessionPolicyDecision. Consistent enforcement across Vaadin and REST.
- [Compliance & CWE Coverage](https://sec.svenruppert.com/docs/compliance/): How jSentinel's credential-security stack maps to OWASP ASVS V2, NIST SP 800-63B and 40 CWE weakness classes — a full feature-to-CWE traceability matrix, threat-vector coverage, and the standards each control is designed against.

## Reference & reports
- [Mutation Reports](https://sec.svenruppert.com/docs/mutation/): Per-module PIT mutation-testing reports for jSentinel — kill rate, test strength, per-mutator breakdown and the surviving-mutant list, rendered in the site design from each module's mutations.xml.
- [Roadmap](https://sec.svenruppert.com/docs/roadmap/): jSentinel roadmap — Konzept-V00.60, V00.70, the V00.71 credential stack, the V00.72 developer-experience release, the V00.75 Security Event Bus, the V00.76 JWT validation stack, the V00.77 OAuth2 RP flows and the V00.78 OIDC / V00.79 identity-interop + hardening releases all delivered. Latest published: 00.79.41. Planned: v00.80 MFA / WebAuthn.
- [Release Notes](https://sec.svenruppert.com/docs/release-notes/): Per-version release notes for jSentinel — scope, new SPIs, breaking changes, migration guides and mutation-coverage numbers for every published jSentinel for Java release.

## Tooling & downloads
- [jSentinel Claude Code skills (zip download)](https://sec.svenruppert.com/downloads/jsentinel-skills.zip): ten skills (Vaadin / REST / Standalone, each with base + persistence + hardening layers, plus a Vaadin↔REST hybrid) that integrate jSentinel into your app from a single prompt. See https://sec.svenruppert.com/docs/skills/.
- [API Reference (Javadoc)](https://sec.svenruppert.com/api/jSentinel-core/): browsable, theme-skinned Javadoc for the published modules — jSentinel-core and the Vaadin, REST and Standalone adapters.

## Solutions & Training
- [Consulting](https://sec.svenruppert.com/solutions/consulting/): Hands-on consulting with the author of jSentinel — Vaadin security, REST authorization, SPI integration, bootstrap hardening, custom permissions, security reviews. Pair-programming, sprints, or workshops. Free 30-min scoping call.
- [jSentinel AI](https://sec.svenruppert.com/ai/): jSentinel AI builds AI systems the secure way — AI strategy & advisory, AI app and software development, corporate (private) LLMs, RAG system development, and personal AI assistants. Secure-by-design, EU-hosted, with data sovereignty built in.
- [AI-Security](https://sec.svenruppert.com/solutions/ai-security/): AI-security consulting from jSentinel — securing RAG and LLM systems: threat modeling, prompt-injection and data-exfiltration defenses, retrieval and tool/agent guardrails, evaluations, and secure architecture reviews. Fixed-scope engagement packages.
- [Support & Maintenance](https://sec.svenruppert.com/solutions/support/): Commercial support and maintenance for the jSentinel open-source libraries — guaranteed response times, security-patch SLAs, version maintenance, backports and a named contact who knows the code.
- [Academy](https://sec.svenruppert.com/academy/): jSentinel Academy — hands-on developer training in application & AI security. Courses: Secure Coding in Java and AI-Security for Developers. Delivered on-site, live-online, or on-demand. For teams and individuals.
- [Secure Coding in Java](https://sec.svenruppert.com/academy/secure-coding-in-java/): Secure Coding in Java — a hands-on developer training from jSentinel Academy. The OWASP risks in real Java code: input handling, authentication & authorization, cryptography & secrets, injection, deserialization, and supply-chain security. On-site, live-online, or on-demand.
- [AI-Security for Developers](https://sec.svenruppert.com/academy/ai-security-for-developers/): AI-Security for Developers — a hands-on jSentinel Academy course on building secure RAG, chat and agent systems: prompt injection, data exfiltration, retrieval and tool guardrails, AuthZ for AI, and adversarial evaluations. On-site, live-online, or on-demand.
## Company
- [About](https://sec.svenruppert.com/company/): jSentinel Ltd. — an independent, EU-based company: open-source Java security, security & AI-security consulting, AI systems built secure by design, and developer training. Founded by Sven Ruppert and Benjamin Ruppert.
- [Security Policy](https://sec.svenruppert.com/company/security/): How to report a vulnerability in jSentinel — responsible disclosure process, contact, scope, supported versions and security advisories.
- [Contact](https://sec.svenruppert.com/company/contact/): Get in touch with jSentinel — AI development (jSentinel AI), security consulting & AI-security, developer training, commercial support, or general enquiries. A short scoping call is free.
- [Sponsor](https://sec.svenruppert.com/sponsor/): Sponsor jSentinel — support the open-source jSentinel for Java library. Tier options from $5/month via GitHub Sponsors, or corporate sponsorship with roadmap input. Project stays EUPL 1.2 with independent EU-based maintenance.
- [Source code (GitHub)](https://github.com/vaadin-developer/security-for-flow): the jSentinel for Java library reactor (issues, releases, demos).