- In Class.forName(String,boolean,ClassLoader), a security check (not a package access check) is described which requires the getClassLoader permission ... but no SecurityException is documented as being thrown.

- In Class.getClassLoader(), ClassLoader.getParent(), ClassLoader.getSystemClassLoader(), and Thread.getContextClassLoader(), the conditions for throwing SecurityException are substantially described in the method description and then summarized in the throws tag. This is the wrong way round. The conditions should be summarized in the description (or ideally not mentioned at all) and be given in full in the throws tag, as demonstrated by Class.get* and ClassLoader.defineClass. It's harder to understand and compare these tricky conditions when methods present them inconsistently.