I'm currently designing a system (as an architect - in the ivory tower ;), and while doing so a security related question popped up that I haven't been able to answer:

As much as I have understood hibernate uses reflection to access public, protected and private methods (and/or fields). If that is true, how can it access those if the security manager of the JVM is up and running? If that were so (implying other libraries can access protected/private methods and fields via reflection), wouldn't my system be vulnerable to security threats?

Many thanks in advance for any clarification - it's very much appreciated!