I didn't know. I looked. There was no keyword.
In Apex, that silence has a meaning. A class without an explicit sharing declaration has no posture of its own. Its behavior depends on whatever context calls it, and you cannot tell from reading the class what it will do. Read it in isolation and the security story is invisible. That ambiguity is the vulnerability.
The three keywords exist to eliminate it. A with-sharing class enforces the sharing rules the org has configured, so the user only sees what they're allowed to see. A without-sharing class ignores those rules entirely, useful when a process legitimately needs elevated access to every record. The inherited-sharing declaration explicitly propagates whatever context called it, which is what most developers assume they're getting when they write nothing at all.
That assumption is the bug.
I've seen it surface in quiet ways. A Lightning component that correctly enforced field-level permissions, but the Apex behind it quietly read every record in the org. No error. No warning. Just a gap between the intent and the execution, running silently in production.
What changed my habit was a simple realization: omission is a declaration. Writing nothing is the same as choosing a posture; it's just choosing it accidentally. The platform has to apply some behavior. If you haven't told it what you intended, you've handed that decision to context you don't control.
Now every Apex class I write has an explicit keyword at the top. Even the ones where without-sharing is the right call. Especially those, because that's when you most want the decision documented as a deliberate choice, not a forgotten one.
Your code is always saying something about security. The only question is whether you said it on purpose.