Everything serializable (and a Java general question)

[Brown, Berlin [GCG-PFS]]

I haven't entirely researched this.  But I know wicket recommends
declaring your model objects as serializable so that if the page
serializes than so do the objects.
 
With this approach, I tend to define all or most of my beans and service
objects as serializable.  Do you have to define an object serializable
if it is accessed from Wicket (say on an event method)?
 
Also, aren't there issues with declaring objects as serializable?  Is it
insecure to put data in a serializable object?  Where by the security
mechanisms for that object can be bypassed?
 
For example.
 
Some Panel.java:
 
final Serializable x = new Serializable() {}
 
final Component z = new Link() {
  onClick {
      x???  <--- does X have to be serializable in this case?
  }
}
 
Berlin Brown (POL)