I would like to take a look, if no one else is interested. I just submitted #1017 to address.  Ok @oconnelc 
SonarCloud reports vulnerabilities
The project is using SonarCloud static code analysis. The latest results are showing that it has found several blocker level vulnerabilities. In this task those are fixed or marked as false positives. To mark false positives, `SuppressWarnings` annotation should be used in code as explained in the linked documentation.

Links:
[Blocker and critical severity vulnerabilities in SonarCloud](https://sonarcloud.io/project/issues?id=iluwatar_java-design-patterns&resolved=false&severities=BLOCKER%2CCRITICAL&types=VULNERABILITY)
[Sonar false positives](https://docs.sonarqube.org/latest/analysis/languages/java/#JavaFAQ-HowtoremoveFalse-Positiveissues)

aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java naked-objects/webapp/src/main/webapp/about/index.html
aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java naked-objects/webapp/src/main/webapp/about/index.html
diff --git a/aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java b/aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java
index cd30afc4807c..ccbe6f2fe68c 100644
--- a/aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java
+++ b/aggregator-microservices/aggregator-service/src/main/java/com/iluwatar/aggregator/microservices/Aggregator.java
@@ -22,11 +22,12 @@
  */
 package com.iluwatar.aggregator.microservices;
 
+import javax.annotation.Resource;
+
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 
-import javax.annotation.Resource;
-
 /**
  * The aggregator aggregates calls on various micro-services, collects
  * data and further publishes them under a REST endpoint.
@@ -47,7 +48,7 @@ public class Aggregator {
    *
    * @return a Product.
    */
-  @RequestMapping("/product")
+  @RequestMapping(path = "/product", method = RequestMethod.GET)
   public Product getProduct() {
     Product product = new Product();
     product.setTitle(informationClient.getProductTitle());
diff --git a/api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java b/api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java
index cbabad1e6ff6..dc4249c6eb3d 100644
--- a/api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java
+++ b/api-gateway/api-gateway-service/src/main/java/com/iluwatar/api/gateway/ApiGateway.java
@@ -23,6 +23,7 @@
 package com.iluwatar.api.gateway;
 
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 
 import javax.annotation.Resource;
@@ -43,7 +44,7 @@ public class ApiGateway {
    * Retrieves product information that desktop clients need
    * @return Product information for clients on a desktop
    */
-  @RequestMapping("/desktop")
+  @RequestMapping(path = "/desktop", method = RequestMethod.GET)
   public DesktopProduct getProductDesktop() {
     DesktopProduct desktopProduct = new DesktopProduct();
     desktopProduct.setImagePath(imageClient.getImagePath());
@@ -55,7 +56,7 @@ public DesktopProduct getProductDesktop() {
    * Retrieves product information that mobile clients need
    * @return Product information for clients on a mobile device
    */
-  @RequestMapping("/mobile")
+  @RequestMapping(path = "/mobile", method = RequestMethod.GET)
   public MobileProduct getProductMobile() {
     MobileProduct mobileProduct = new MobileProduct();
     mobileProduct.setPrice(priceClient.getPrice());
diff --git a/naked-objects/webapp/src/main/webapp/about/index.html b/naked-objects/webapp/src/main/webapp/about/index.html
index 176bfc13a3f6..e929c5b6da33 100644
--- a/naked-objects/webapp/src/main/webapp/about/index.html
+++ b/naked-objects/webapp/src/main/webapp/about/index.html
@@ -82,12 +82,12 @@
              
             <p>
                 This app has been generated using Apache Isis'
-                <a href="http://isis.apache.org/intro/getting-started/simple%61pp-archetype.html" target="_blank">SimpleApp</a> archetype,
+                <a href="http://isis.apache.org/intro/getting-started/simple%61pp-archetype.html" target="_blank" rel="noopener noreferrer">SimpleApp</a> archetype,
                 to create a purposefully minimal application that nevertheless includes fixture data, integration tests and BDD specs.
                 <br/>
                 <br/>
-                The app itself consists of a single domain class, <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/dom/src/main/java/dom/simple/SimpleObject.java"  target="_blank"><tt>SimpleObject</tt></a>,
-                along with an equally simple (factory/repository) domain service, <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/dom/src/main/java/dom/simple/SimpleObjects.java"  target="_blank"><tt>SimpleObjects</tt></a>.
+                The app itself consists of a single domain class, <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/dom/src/main/java/dom/simple/SimpleObject.java"  target="_blank" rel="noopener noreferrer"><tt>SimpleObject</tt></a>,
+                along with an equally simple (factory/repository) domain service, <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/dom/src/main/java/dom/simple/SimpleObjects.java"  target="_blank" rel="noopener noreferrer"><tt>SimpleObjects</tt></a>.
             </p>
 
             <p>To access the app:</p>
@@ -98,8 +98,8 @@
                     </p>
                     <p>
                         provides accesses to a generic UI for end-users,
-                        Isis' <a href="http://isis.apache.org/components/viewers/wicket/about.html" target="_blank">Wicket Viewer</a>.
-                        As its name suggests, this viewer is built on top of <a href="http://wicket.apache.org" target="_blank">Apache Wicket</a>&trade;.
+                        Isis' <a href="http://isis.apache.org/components/viewers/wicket/about.html" target="_blank" rel="noopener noreferrer">Wicket Viewer</a>.
+                        As its name suggests, this viewer is built on top of <a href="http://wicket.apache.org" target="_blank" rel="noopener noreferrer">Apache Wicket</a>&trade;.
                     </p>
                 </li>
                 <li>
@@ -118,7 +118,7 @@
 
             <p>
             The default user/password is <b><i>sven/pass</i></b> (as configured in the
-            <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/webapp/src/main/webapp/WEB-INF/shiro.ini" target="_blank">shiro.ini</a> file).
+            <a href="https://github.com/apache/isis/blob/master/example/application/simple%61pp/webapp/src/main/webapp/WEB-INF/shiro.ini" target="_blank" rel="noopener noreferrer">shiro.ini</a> file).
             </p>
             
         </div>
