Serialization

Serialization converts state to bytes or text. A durable format defines schema, field meanings, versions, encoding, limits, and compatibility independent of an in-memory class layout.

Explicit data transfer

record UserDto(long id, String name) {}

String encode(UserDto user) {
    return "{\"id\":" + user.id() + ",\"name\":\"" +
        escapeJson(user.name()) + "\"}";
}

Use a maintained JSON/CBOR/Protocol Buffers library rather than hand-building real JSON. Java native Serializable uses object graphs, serialVersionUID, and transient, but deserializing untrusted bytes can trigger dangerous behavior. Prefer allow-listed explicit schemas, validate before constructing domain objects, cap depth/size, and never serialize credentials or live resource handles.