Security defaults that belong in every Spring Boot application from day one.
88
83%
Does it follow best practices?
Impact
97%
1.79xAverage score across 5 eval scenarios
Passed
No known issues
A content team needs a REST API for their blogging platform. The API is built with Spring Boot and Java. A Next.js frontend hosted on a different domain will consume it. The API will run on Kubernetes behind an ingress controller.
The API needs the following endpoints:
GET /api/posts -- list all published posts (supports ?page=1&size=10 pagination)GET /api/posts/{slug} -- get a single post by URL slugPOST /api/posts -- create a new blog post (accepts title, content, tags array, authorName)PATCH /api/posts/{slug} -- update an existing postDELETE /api/posts/{slug} -- delete a postPOST /api/posts/{slug}/comments -- add a comment (accepts authorName, body)GET /api/posts/{slug}/comments -- list comments for a postUse an in-memory data store. Posts should have id, title, slug, content, tags, authorName, comments, published, and createdAt fields. Generate slugs from titles.
Produce:
PostController.java -- REST controller with all blog post endpointsPost.java -- Post modelCreatePostRequest.java -- Request DTOSecurityConfig.java -- Security configurationGlobalExceptionHandler.java -- Exception handlingpom.xml -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
springboot-security-basics
verifiers