Spring Boot Actuator: Why exposing all endpoints with '*' is a risky shortcut

Spring Boot Actuator is a powerful operational tool, but a widely copied tutorial pattern — enabling all endpoints with a single wildcard — can inadvertently expose sensitive data in production environments. By default, Spring Boot only exposes the 'health' and 'info' endpoints over HTTP, yet developers routinely override this without a clear access policy. Endpoints such as '/actuator/env', '/actuator/heapdump', and '/actuator/shutdown' can leak environment variables, JVM memory contents, or allow remote application shutdown if left unguarded. Spring Boot does not automatically add authentication to Actuator endpoints, making it the developer's responsibility to define who can access what and from where. The core issue is not the tool itself, but the absence of an explicit policy governing which endpoints to enable, expose, and restrict based on the specific operational context.