SEC-027
Spring Boot Actuator endpoints are public
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/actuator, /actuator/env and /actuator/heapdump.
Why it matters
/actuator/env lists configuration properties and /actuator/heapdump downloads the server’s memory, which contains passwords, session tokens and customer data.
Recommended fix
Expose only health and info over HTTP (management.endpoints.web.exposure.include=health,info) and protect the rest.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-027: Spring Boot Actuator endpoints are public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Lock down Spring Boot Actuator: expose only health and info over HTTP, require authentication for any other management endpoint, and confirm /actuator/env and /actuator/heapdump return 404 or 401.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.