Reflection is a complete API for getting inside classes. Private members and all.
In cases where you don't trust the code you're running (applets and the like) you can prevent the code from using reflection at all. See this Stack Overflow question for details.