Eelco took my original ten minute hack and ran with it, and has produced something that covers a lot more edge cases. It handles anonymous inner classes, externalizables, things with custom writeObject() functions and a bunch of other stuff. It also plays nicely with SecurityManagers. You can find the code in Wicket 1.3’s SerializableChecker.java. It has a couple of custom Wicket bits, but would be completely trivial to strip those out if you wanted to use this somewhere else. At about 700 lines, it’s a bit more complicated than we both expected it to be, but it’s pretty robust. Good work Eelco!