# Java Safety and Error Handling

Apply these rules when handling external input, failures, resources, or logs.

* Validate size, range, format, and allowed values before expensive parsing, allocation, or side effects. Keep validation consistent with business and security constraints.
* Reject null where a value is required, with clear argument or boundary validation. Do not hide invalid state behind default values that change behavior.
* Use try-with-resources for owned `AutoCloseable` resources. Keep ownership explicit and do not close resources supplied by a caller unless the contract says so.
* Catch only failures the current layer can handle. Preserve exception causes and useful context; do not swallow failures, catch broadly to continue with partial state, or use exceptions for routine control flow.
* Preserve interruption and cancellation during error handling. Timeouts and retries need bounds and must not silently turn failure into success.
* Use structured logs where the project supports them. Never log credentials, tokens, personal data, or unbounded payloads; avoid excessive logging in hot paths.
* Return safe, consistent error information. Do not disclose protected resource existence or internal details to unauthorized callers.