OK, so I'm still digging and don't have answer yet but I thought I'd give an update in case it sparks an idea and it'll be useful as a future reference.
Firstly getting to the real error is a challenge because Guice on Appengine does a lot of recursion when creating dependency trees. In this case the real SecurityException is 4 levels down the the appengine only shows three levels. So I put a try catch in my servlet config class (IntegrationServletConfig) and then unwrapped the nested exceptions so see the culprit. Bear in mind that I cannot reproduce locally so I have to upload a new version for each test - yuck! This did yield a result. The SecurityException comes from Class.getDeclaredMethods.... java.lang.SecurityException: Unable to get members for class com.pbw.core.database.MappingUtils at com.google.appengine.runtime.Request.process-131516640218e6d2(Request.java) at java.lang.Class.getDeclaredMethods(Class.java:252) at com.google.inject.spi.InjectionPoint$Factory $2.getMembers(InjectionPoint.java:395) at com.google.inject.spi.InjectionPoint$Factory $2.getMembers(InjectionPoint.java:393) at com.google.inject.spi.InjectionPoint.addInjectorsForMembers(InjectionPoint.java: 359) at com.google.inject.spi.InjectionPoint.addInjectionPoints(InjectionPoint.java: 353) at com.google.inject.spi.InjectionPoint.forInstanceMethodsAndFields(InjectionPoint.java: 296) at com.google.inject.MembersInjectorStore.createWithListeners(MembersInjectorStore.java: 78) at com.google.inject.MembersInjectorStore.access $000(MembersInjectorStore.java:35) at com.google.inject.MembersInjectorStore $1.create(MembersInjectorStore.java:43) at com.google.inject.MembersInjectorStore $1.create(MembersInjectorStore.java:40) at com.google.inject.internal.FailableCache $1.apply(FailableCache.java:35) at com.google.inject.internal.MapMaker $StrategyImpl.compute(MapMaker.java:549) So now I know that something about the methods in my MappingUtils class are not ok for the appengine. I guess that the real answer is in this line... at com.google.appengine.runtime.Request.process-131516640218e6d2(Request.java) but I'll need someone at Google to look into that as it only occurs on the appengine. This got me thinking - what has changed? I've been using the class with no problems for 6 months. Here are the candidates.. - a new method : I added a new method that returns Class<?> : when I removed it the error still occurs - a newer version of the Appengine : I upgraded to 1.3.1 : I downgraded to 1.3.0 and had the same problem. Now I'm lost for ideas. If you have a suggestion for a next move I'd love to hear it. Thanks -- You received this message because you are subscribed to the Google Groups "Google App Engine for Java" group. To post to this group, send email to google-appengine-j...@googlegroups.com. To unsubscribe from this group, send email to google-appengine-java+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/google-appengine-java?hl=en.