Hilla uses Spring Security with some Vaadin-specific things defined on top of it in VaadinWebSecurity.