(User)[https://github.com/Cloudname/cloudname/blob/master/a3/src/main/java/org/cloudname/a3/domain/User.java].computeHashCode() assumes that roles and properties are not null but this isn't enforced/checked anywhere and can lead to NPE. Null collections are evil, these to properties should be initialized to empty collections to avoid this possibility or wherever User is created it should be checked that all the provided values were provided.