https://wordpress.foojay.io/today/avoid-java-serialization/