saveRules() API fails with NPE when saving a rule that doesn't have the users list set

There is nothing that prevents a WritableSecurityRule from being created with null for the list of users or groups, and the saveRules() API doesn't handle at all that case, it fails with a Null Pointer Exception.

It should handle the null as an empty list.