Fix exposed Actuator endpoints

Free Spring Boot lab: /actuator/env and heapdump are public with secrets in JSON. Lock down exposure.include in the browser — no sign-up.

Security finds /actuator/env and /actuator/heapdump on the public internet, with database passwords in the JSON. The prod YAML shipped management.endpoints.web.exposure.include: '*'.

Spring Boot Actuator is useful for health and metrics. include: '*' also opens env, heapdump, shutdown, and beans. Without Spring Security on /actuator, anyone can dump secrets or take a heap snapshot.

The lab is a production YAML review: expose only health, info, and prometheus; set health show-details to when-authorized; disable env and heapdump. This is the most common Spring Boot security miss in audits.

What you will cover

Symptom: /actuator/env returns secrets; heapdump is public
Root cause: exposure.include: '*' with no actuator auth
Wrong fix: hiding the path without restricting endpoints
Right fix: include health,info,prometheus only
Disable env, heapdump, and shutdown in production

Related free labs and modules

Common questions

Why is Spring Boot Actuator dangerous if fully exposed?

Endpoints such as /actuator/env and /actuator/heapdump leak environment variables, datasource passwords, and heap contents. include: '*' on a public port is a common breach pattern. Production should expose health and metrics only, behind auth.

Which Actuator endpoints should production expose?

Typically health, info, and prometheus. Set health show-details to when-authorized. Disable env, heapdump, logfile, and shutdown. Put /actuator behind Spring Security even for health if the network is not private.

Is the exposed Actuator lab free?

Yes. You can lock down the misconfigured production YAML in the browser with no account.

Free Spring Boot debug challenges · Free debug challenges · Java Spring Boot path · Create free account