Spring Boot's default env sanitizer may expose secrets that break naming conventions

Spring Boot's /actuator/env endpoint includes a built-in sanitizer that masks property values containing keywords like 'password', 'secret', or 'token', but it only covers names that match those predefined patterns. Teams that use custom variable naming conventions — such as DB_PASS, API_AUTH, or WEBHOOK_SIGNING — may unknowingly expose sensitive values in plain text. The official Spring Boot documentation acknowledges that sanitization behavior is configurable via the SanitizingFunction interface, but leaves the responsibility of defining project-specific patterns to the developer. A common misconception is that restricting access via 'management.endpoint.env.show-values=when-authorized' is sufficient, when in fact it only controls who can view values, not which values remain unmasked. Security incidents most often arise not from misspelled standard keywords but from team-specific naming dialects that were never added to the sanitizer's pattern list.