On the page:
https://docs.oracle.com/javase/tutorial/essential/environment/security.html

in the section:
Recognizing a Security Violation

the example uses a FileReader and file named xanadu.txt:
new FileReader("xanadu.txt");

but the stack trace mentions and FileWriter and a file named characteroutput.txt