Most of it is installed as source files in your mvc project so you are free to change and inspect things. This is where protection against XSS/XSRF/over-posting attacks is handled as in Mvc. Only the core module is delivered as closed library. But that is more of a business layer than the security layer. The best thing about the core module is that every piece is swappable (including salted password hashing with key stretching piece) as everything is based on service pattern (interfaces and contracts).