Spring Boot Actuator Endpoints Can Leak Secrets If Enabled Without a Clear Policy

Spring Boot Actuator is a powerful operational tool, but a widely copied tutorial pattern that exposes all endpoints at once with a single wildcard setting can create serious security gaps. By default, Spring Boot only exposes the health and info endpoints over HTTP, while more sensitive ones like env, heapdump, loggers, and shutdown remain inaccessible unless explicitly enabled. Endpoints such as env can leak environment variables, API keys, and database URLs, while heapdump can expose live in-memory application data. Spring Boot does not automatically add authentication to Actuator routes, making it the developer's responsibility to define access controls and separate management ports from public traffic. Security experts advise teams to audit which endpoints are genuinely needed for operations before deploying, rather than defaulting to blanket exposure.