Effective Java

by Joshua Bloch

(without resorting to extralinguistic means such as native methods and reflection).

Which aren't out of the realm of probable, which is why this should clarify the guarantee may not apply when it comes to security.