How secure is Spring Security?

Earlier versions of Spring security (known as acegi back in the day) required quite a large amount of configuration and it was therefore possible to miss something and leave a hole in your security. Recent versions have significantly reduced the complexity and now use sensible defaults.

However Spring still remains extremely flexible and extensible which gives developers great power, but as always power comes with responsibility. As far as Spring security is concerned a little knowledge is a dangerous thing, I'd strongly recommend that you get a good understanding of the framework before undertaking any customization. It's also a good idea to get involved on the forums and ask the communityto peer review high risk areas of code/customization.

We've implemented Spring security for many banks and other financial institutions both in the US and Europe so in that sense it's definitely "fit for purpose"