Internal functions that could cause UB if misused should be marked unsafe

[programmerjake]

A good example is Context::new:

The following safe code can cause UB:

fn crash() {
    drop(Context::new(23 as LLVMContextRef));
}

This isn't actually a soundness issue since those functions aren't publicly accessible, however I think it's a code-style issue that goes against the safety ethos of Rust.

[TheDan64]

This is an interesting point