The software declares a critical variable, field, or member to be public when intended security policy requires it to be private.