=>During construction objects are at an awkward stage where they exist but are not ready for use. Such awkwardness presents a few more difficulties in addition to those of ordinary methods.
AVOID EXPOSING CONSTRUCTORS OF SENSITIVE CLASSES
―Define static factory methods instead of public constructors. ―Prefer delegation over inheritance. ―Avoid construct through serialization and clone.
PREVENT THE UNAUTHORIZED CONSTRUCTION OF SENSITIVE CLASSES
―A security-sensitive class enables callers to modify or circumvent SecurityManager access controls.
―To restrict untrusted code from instantiating a class, enforce a SecurityManager check at all points where that class can be instantiated.
DEFEND AGAINST PARTIALLY INITIALIZED INSTANCES OF NON-FINAL CLASSES PREVENT
CONSTRUCTORS FROM CALLING METHODS THAT CAN BE OVERRIDDEN
―Constructors that call overridable methods give attackers a reference to this (the object being constructed) before the object has been fully initialized.
DEFEND AGAINST CLONING OF NON FINAL CLASSES
―A non-final class may be subclassed by a class that also implements java.lang.Cloneable.
―The result is that the base class can be unexpectedly cloned.