> Internal use of unsafe requires securing the safe code at the module boundary
Not even that, because you can pass data structures from unsafe code at arbitrary depth.
Not even that, because you can pass data structures from unsafe code at arbitrary depth.
You seem to be talking either about improper encapsulation or unsafe that is intended to be exported and used unsafely. Or perhaps some method that is not sound according to the language.