Spring Boot Actuator in Production: The Endpoints I Left Open by Accident and How I Closed Them I was reviewing the configuration of a Spring Boot 3.x backend I've been building — the same one I talked about in Jakarta EE vs Spring Boot — when I did something I should have done on day one: a simple curl against /actuator . The response hit me like a bucket of cold water. { "_links" : { "self" : { "href" : "http://localhost:8080/actuator" }, "beans" : { "href" : "http://localhost:8080/actuator/beans" }, "health" : { "href" : "http://localhost:8080/actuator/health" }, "info" : { "href" : "http://localhost:8080/actuator/info" }, "env" : { "href" : "http://localhost:8080/actuator/env" }, "loggers" : { "href" : "http://localhost:8080/actuator/loggers" }, "metrics" : { "href" : "http://localhost:8080/actuator/metrics" }, "mappings" : { "href" : "http://localhost:8080/actuator/mappings" }, "threaddump" : { "href" : "http://localhost:8080/actuator/threaddump" }, "heapdump" : { "href" :…