When using controller.secuirty vs method.security the value should cloned rather than copied. If @Secuirty decorator defined as @Security('*', 'basic') then produced value will be ['*'] - Array, which in case of multiple methods will reference the same internal object.

Without cloning the value, underlying swagger2openapi library fails with S2OError: YAML anchor or merge key.

Proposed fix:

 method.security = method.security || (controller.security ? JSON.parse(JSON.stringify(controller.security)) : controller.security);