Returning a Mutable Object to an Untrusted Caller

When a function returns a reference to an object like an array, collection, or custom data structure without making a defensive copy, the caller gains the power to change the object's contents. Since both the class and the caller hold references to the same underlying data, any modifications made by the caller directly alter the class's internal state. This breaks a core principle of encapsulation, as the class can no longer control or guarantee the integrity of its own data. To prevent this, methods should never return direct references to mutable internal fields. Instead, return a deep copy of the data or an immutable view (like an unmodifiable wrapper). This practice ensures the calling code can use the returned data without being able to corrupt the original object's state, preserving the class's invariants and security.