CDI extension DeltaSpike allows to create custom autorizer which decides whether the secured method invocation should proceed. It is possible to base the authorization logic on the result of the secured method - using annotation @SecuredReturn. (See documentation of Deltaspike/Security Module)

When the return type of the secured method doesn't match the type of authorizer method parameter annotated with @SecuredReturn then application fail with exception "SecurityDefinitionException: No matching authorizer found for security". Validator doesn't detect any problems.

This issue can be reproduced on attached project securedReturn.zip