CWE-487
Reliance on Package-level Scope
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
Impactr finds and proves whether CWE-487 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.