1) By restricting who has access to the production server (only the sysadmin is allowed to deploy apps to production) and by using code reviews to make sure that no developer write a datasource fishing app. For really secure environments, an app server instance per app is also used. 2) Enter a JIRA issue at http://jira.jboss.org/. You can use your forum account and password to log into JIRA. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4250216#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...