Note that this policy does not apply to classes under the org.owasp.esapi.reference package. You generally are not expected to be using such classes directly in your code. At the ESAPI team's ...