It could easily go past module boundaries. The point of the article is that the &quot;unsafety&quot; extends however far the invariants the unsafe code depend on extend.<p>I could have an unsafe function that depends on a set being non-empty. And it could share that set with, say, a factory in a different module. So someone could mess with that code and cause the invariants to be violated, and suddenly the code is broken.<p>Unless you have a language that is capable of expressing proofs (ie, Idris) you have to depend on good documentation and careful&#x2F;tasteful design to prevent this kind of problem.