I've checked its output on my server application, and it's a bit hard to get something useful out of it. E.g., it seems to label anything unsafe as CAPABILITY_A

I've checked its output on my server application, and it's a bit hard to get something useful out of it. E.g., it seems to label anything unsafe as CAPABILITY_ARBITRARY_EXECUTION, which includes json-iterator. However, it doesn't say so, it says it at every point where a path to json-iterator starts, and the path ends in some other package. So you have to inspect each of these messages and find out which package is "really" responsible. However, the output is 200k lines. That's longer than my program. And even if I crawl through all messages, it won't help me when the libraries update. So, this may be a step towards safety, but it's not a very practical one.