diff --git a/dhscanner-kbapi.cabal b/dhscanner-kbapi.cabal
--- a/dhscanner-kbapi.cabal
+++ b/dhscanner-kbapi.cabal
@@ -28,7 +28,7 @@
     fundamental modifications to the structure or specification
     of code facts.
 
-version:            1.3.0
+version:            1.4.0
 license:            GPL-3.0-only
 license-file:       LICENSE
 author:             OrenGitHub
diff --git a/json-schema-creator/Main.hs b/json-schema-creator/Main.hs
--- a/json-schema-creator/Main.hs
+++ b/json-schema-creator/Main.hs
@@ -59,6 +59,7 @@
 instance ToSchema WithHttpHandlers.RequestPart
 instance ToSchema WithHttpHandlers.Authentication
 instance ToSchema WithHttpHandlers.AuthEvidence
+instance ToSchema WithHttpHandlers.SecurityAnnotation
 
 instance ToSchema WithControlFlowReachableSinks.Features where declareNamedSchema = genericDeclareNamedSchema (qualifiedAs "WithControlFlowReachableSinks")
 instance ToSchema WithControlFlowReachableSinks.Sink
diff --git a/src/WithHttpHandlers.hs b/src/WithHttpHandlers.hs
--- a/src/WithHttpHandlers.hs
+++ b/src/WithHttpHandlers.hs
@@ -123,7 +123,29 @@
 --   path falls through implicitly. No payload \- the evidence /is/
 --   the shape, and the callable\'s name is already carried by
 --   'authenticationFunctionName'.
+--
+-- * @ByAnnotations [ SecurityAnnotation ]@ \- the handler, or its
+--   hosting class, carries security annotations ( spring's
+--   @\@PreAuthorize@, @\@Secured@, @\@RolesAllowed@, ... ). Every
+--   annotation in effect is listed : spring checks each kind on its
+--   own, and the method annotation overrides the class one of the same
+--   kind. 'authenticationFunctionName' holds the first one's short name
+--   ( e.g. @\"PreAuthorize\"@ ).
 data AuthEvidence
    = ByHeaderNullCheck String
    | ByAllButOneBadReturn
+   | ByAnnotations [ SecurityAnnotation ]
    deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- | A security annotation in effect on a handler, e.g.
+-- @\@Secured( { \"ROLE_A\", \"ROLE_B\" } )@ has const string args
+-- @[ \"ROLE_A\", \"ROLE_B\" ]@ ( array args are flattened, args that
+-- are not constant strings are skipped ).
+data SecurityAnnotation
+   = SecurityAnnotation
+     {
+         securityAnnotationFqn :: String,
+         securityAnnotationLocation :: Location,
+         securityAnnotationConstStrArgs :: [ String ]
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )