https://foojay.io/today/avoid-java-serialization/