To mitigate this, explicitly define final readObject() to prevent deserialization. An example of this is:
(good code)
private final void readObject(ObjectInputStream in) throws java.io.IOException {
throw new java.io.IOException("Cannot be deserialized"); }