Two fixes:

* Consider that the @WebService annotation (et al) can be in a supertype or interface

* getARemoteMethod should only return public methods, since protected, package-private, and private methods are not exposed

java/ql/lib/semmle/code/java/frameworks/JaxWS.qll

@@ -25,7 +25,7 @@ string getAJaxRsPackage(string subpackage) { result = getAJaxRsPackage() + "." +
  */
 class JaxWsEndpoint extends Class {
   JaxWsEndpoint() {
-    exists(AnnotationType a | a = this.getAnAnnotation().getType() |
+    exists(AnnotationType a | a = this.getAnAncestor().getAnAnnotation().getType() |
       a.hasName(["WebService", "WebServiceProvider", "WebServiceClient"])
     )
   }
@@ -37,6 +37,7 @@ class JaxWsEndpoint extends Class {
    */
   Method getARemoteMethod() {
     result = this.getACallable() and
+    result.isPublic() and
     not result instanceof InitializerMethod and
     not exists(Annotation a | a = result.getAnAnnotation() |
       a.getType().hasQualifiedName(["javax", "jakarta"] + ".jws", "WebMethod") and