I gave some strategies for the implementation but pointed out the possible vulnerabilities as well. Obvious suggestions were declaring the members final, however that still presents the possibility to modify the object if the members are mutable. Another strategy is to never return the actual objects, but deep clone them inside getter methods.