https://symfony.com/doc/current/reference/configuration/security.html has a messed up heading hierarchy.

access_control and firewalls are top-level keys, not subkeys of session_fixation_strategy. And all headings coming after firewalls should be sub-heading of firewalls as they document its subkeys. role_hierarchy and providers are also top-level jets but are documented as subkeys of required_badges (which is should be one of the firewalls subkeys)

some other things also don't make sense at all. delete_cookies is a sub-key of logout but is not documented as such (fortunately, there is a code snippet).