java-cache — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited java-cache (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect the cache provider in use, then apply the correct patterns.
Check pom.xml or build.gradle:
spring-boot-starter-data-redis → Redis (Lettuce client by default)spring-boot-starter-cache + caffeine → Caffeine (in-process)spring-boot-starter-cache only → Simple (ConcurrentHashMap, dev only)Check Spring Boot version:
reviewUser asks to review existing cache configuration. Check for:
@EnableCaching present on a @Configuration class — missing it silently disables all cache annotationsapplication.yml with explicit TTL — no unnamed or unbounded caches@Cacheable methods are on Spring-managed beans (not private, not called within the same class — proxy bypass)@Cacheable(key = "#id") not #root.methodName unless intentional@CacheEvict present wherever data is mutated — missing eviction causes stale cache@CachePut used to update cache on write — not a @CacheEvict + re-fetch patternGenericJackson2JsonRedisSerializertime-to-live, entries never expiremaximumSize set — without it, cache grows unbounded and causes OOM@Cacheable(unless = "#result == null") to avoid caching nullsmanagement.metrics.cache.instrument=truesetupUser asks to add caching from scratch.
spring-boot-starter-cache + com.github.ben-manes.caffeine:caffeine@EnableCaching to a @Configuration classapplication.yml — set maximum-size and expire-after-write@Cacheable, @CacheEvict, @CachePutspring-boot-starter-data-redisspring.data.redis.host/port (Boot 3.x) or spring.redis.host/port (Boot 2.x)RedisCacheConfiguration bean — set TTL and use GenericJackson2JsonRedisSerializer@EnableCaching and annotate service methodsSee references/patterns.md for full configuration examples.
cacheableUser asks to cache the result of a method.
@Cacheable(cacheNames = "products", key = "#id") on the service methodprivateunless = "#result == null" to avoid caching null resultsSerializable (Redis) or any object (Caffeine)@CacheEvict on the update/delete methodevictUser asks to invalidate/evict cache entries on data changes.
@CacheEvict(cacheNames = "products", key = "#id") — evict a single entry on update/delete@CacheEvict(cacheNames = "products", allEntries = true) — evict all entries (use sparingly)@CacheEvict(beforeInvocation = true) — evict before method runs (use when method may throw)@Caching(evict = { @CacheEvict("products"), @CacheEvict("productList") })redisUser asks specifically for Redis cache configuration.
spring-boot-starter-data-redisspring.data.redis.host, spring.data.redis.port, spring.data.redis.passwordRedisCacheManager bean with:GenericJackson2JsonRedisSerializer for values (human-readable, portable)StringRedisSerializer for keys@EnableCachingspring.data.redis.cluster.nodesspring.data.redis.sentinel.master and nodesFor review mode: list findings as [CRITICAL] / [HIGH] / [MEDIUM] / [LOW] with file:line references.
For implementation modes: show exact Maven/Gradle dependency, full application.yml block, and complete Java configuration + annotated example. State minimum Spring Boot version where it differs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.