Servlet using resourceType

1. How secure the servlet is - It depends on what access the node which has that resoucetype, has.

2. Request has what user permissions - The permissions of the user who is accessing that node, which triggered this servlet.

A servlet using resourceType and obtaining a ResourceResolver via request.getResourceResolver() operates with the permissions of the user tied to the request. This ensures actions are constrained by the user's permissions (public users will be anonymous user), adhering to AEM's security model. The servlet inherently inherits the user's access scope, making it as secure as the requesting user's permissions. However, risks arise if the servlet doesn't validate or sanitize inputs properly, potentially exposing sensitive operations or data. To maintain security, ensure the servlet implements robust input validation, adheres to the principle of least privilege, and limits actions to only what is necessary for the servlet's purpose.

anonymous user or everyone group typically can read nodes in the repository based on the permissions granted to the everyone group. If this user calls the servlet, and the request is adapting to the ResourceResolver object, the everyone group typically has no write permissions

If the servlet is called from author, then will have current logged-in user permissions.
If it called from publish(live site), then will only have read access to /content