file:${java.home}/lib/security/java.policy file:${user.home}/.java.policy These policy files are specified in the default security file: ${java.home}/lib/security/java.security