• Data at rest is dangerous. Data in motion is safer
• A lot of times, you can store your data "somewhere else" (in a database usually)
• When you need to store state, limit how it can be accessed
• Especially limit where data can be written
• Java access modifiers (public, private, protected) are a good defense
• Make data private where possible
• Make member variables final where possible

13 / 23