Mention few advanced coding concepts in Java for security considerations.

Avoiding Strings for volatile secrets: Storing passwords in String objects increases the application risk profile since Strings will remain on the heap until garbage collection.

Avoid Deserializing objects from untrusted sources: The serialization framework calls readObject() on each Serializable object to deserialize itself. An attacker may simply include malicious code in the Object's readObject method. This is then executed by Java serialization framework when the object is deserialized.

Java Native Interface (JNI) bypassing Platform Safety Controls And Buffer overflows: JNI offers incredible controls of the virtual machine. but essentially bypasses most platform security controls.

DTD/XML External Entity (XXE): The XXE attack is made possible by weakness in the XML parser that allows attackers to exfilterate sensitive information on the server.

XML Entity Expansion (XEE): A relatively small XML document that expands into an unanticipated large document. Used by attackers to slow/crash an application.