The existing documentation regarding Spring Security and Vaadin is generally sufficient, but it is not yet clear regarding NotFoundException. Since the default for any unknown request is now "deny all" it should be clarified in relation to "...CustomNotFoundTarget extends RouteNotFoundError..." that this configuration alone is NOT sufficient to trigger such a message. Additionally, the VaadinSecurityConfigurer has to be customized too. Please update the documentation.