Security Is a Feature You Already Have: Building Fast and Safe on Liferay
Presenter: Zsolt Balogh, VP, Technology Operation, Liferay
Most developers treat security as something that happens to their code after they’ve written it: a scan that fails the build, a permissions ticket, a CVE that lands on a Friday. This talk makes the opposite case: on Liferay, security is a capability you already have in the platform, and using it well is what lets you move fast.As Liferay’s head of Information Security, I’ll walk through how we secure Liferay itself and what that means for how you build on it. We’ll look at the security primitives already in your hands: the permissions and identity model, OAuth2 and headless API authorization, CSP, and how these hold up as you wire Liferay into the rest of your world through REST, MCP servers, and AI-powered pipelines. I’ll show where the new AI surfaces (RAG inputs, agent permissions, AI-generated code, low-code apps reaching production) actually change your risk, and how Liferay’s existing model absorbs more of that than you’d expect.How we find and fix vulnerabilities in Liferay, how we handle the upstream flood so you don’t have to, and why our release cadence is a security control. How often should you actually upgrade, and what does staying current buy you? You’ll leave knowing which platform features to reach for, which habits keep you fast, and why on Liferay the secure path and the fast path are the same path.