In particular check that we don't expose implementation types or SPIs through our APIs. I know we currently do, so this will have to be a soft check for now, mainly for information.

We already have something in Hibernate Validator using jqassistant, and apparently it works pretty well. Maybe start from there?

https://github.com/hibernate/hibernate-validator/blob/master/jqassistant/rules.xml