Q: Solution to "Public static final" security hole This is a security hole in java:
// Potential security hole!

static public final Thing[] VALUES = { ... };

A general solution can be
private static final String[] VALUES = { "a", "b" };   
public static final String[] values()
{
    return VALUES.clone();
}

I thought that a cloned array still allows modifying the internal values, why this is considered an accepted solution?

A: It allows modifying the content of the copy of the original array. But the original array isn't modified. 
And since each caller of values() receives a separate copy, one caller modifying its copy doesn't affect the other caller.
That said, you should generall prefer collections over arrays. And collections can be made unmodifiable, which avoids doing copies.
public static final List<Thing> VALUES = Collections.unmodifiableList(Arrays.asList(...));

Note however that, whatever the solution you choose, if Thing isn't immutable, anyone can still modify the state of the things, without modifying any array or list.
