It would be helpful to add a code sample to guideline 5-3 (View deserialization the same as object construction) of http://java.sun.com/security/seccodeguide.html to help readers understand how to use the ObjectInputStream.readField method. I don't think that is a well understood API and an example would be very helpful here.