Also the Elytron and security manager modules need reviewing to ensure only the correct APIs are exposed as public APIs with the remainder either not exported or flagged as private.