security-checklist

To audit security vulnerabilities in a Micronaut and Kotlin backend, apply a strict checklist verifying endpoint authentication, authorization rules, input validation, and secrets management to prevent common security gaps.

Before merging new Micronaut endpoints, verify that all endpoints are annotated with @Secured, admin endpoints use OAuthSecurityRule.ADMIN, inputs are validated with @Valid and Jakarta annotations, and no raw SQL queries are present.

Yes, the security checklist enforces authorization for Micronaut Kotlin applications by requiring all endpoints to be annotated with @Secured and ensuring admin endpoints specifically use OAuthSecurityRule.ADMIN.

To validate input and prevent raw SQL queries in Kotlin backend code, enforce the use of @Valid and Jakarta annotations for input validation while strictly prohibiting raw SQL queries to protect sensitive data from exposure.

The best way to manage secrets and protect sensitive data in Micronaut backends is to run a comprehensive security audit that checks secret handling patterns and ensures sensitive data is protected from exposure across all new or changed endpoints.