Module exports all functions despite intended privacy with -export_all

Symptom

A module compiled with the -export_all attribute makes every function publicly callable, even those meant to stay internal. The compiler emits no warning, so the exposure can go unnoticed until another module or an external caller invokes a private function via erlang:apply/3.

Constraints and uncertainty

• Current OTP releases (26, 27) still support -export_all but list it as a legacy feature.
• Community discussion has not settled on deprecation, warning, or removal in future versions.
• Static analysis tools may flag the attribute, yet the language itself provides no compile‑time guard.

Open questions

1. Will upcoming OTP releases deprecate or turn -export_all into a compiler error?
2. What is the recommended migration path for codebases that rely on the attribute for metaprogramming?
3. How can existing modules be reliably scanned for accidental public exposure without executing them?