A Java applet is trusted when the .class file can be found and executed
using the local CLASSPATH variable. Otherwise it is NOT trusted and can
not, for example, access files.

The property java.class.path should not be readable.