Rule Definition
Java bytecode has no concept of inner classes, so the compiler translates inner classes into ordinary classes that are accessible to any code in the same package. An inner class gets access to the fields of the enclosing outer class even if these fields are declared private and the inner class is translated into a separate class. To let this separate class access the fields of the outer class, the compiler silently changes these fields' scope from private to package. As a result, when inner classes are declared, they are exposed but also the compiler silently overrules the decision to make some fields private. This is a threat to both the stability and the security of the application.

Remediation
Make the inner class a standard class.

Violation Code Sample

public class BankAccount {

  private class AccountKey {  
    // VIOLATION
  }
}

Fixed Code Sample

public class BankAccount {

}

class AccountKey {  
    // FIXED
  }

Gary McGraw & Ed Felten, http://www.securingjava.com/preface.html, http://www.owasp.org/index.php/Java_leading_security_practice#Inner_Classes, http://www.cs.umd.edu/~pugh/java/SecureInnerClasses.pdf