Restrict Spring Boot actuator web exposure to non-sensitive endpoints
Actuator `management.endpoints.web.exposure.include` should not expose wildcards or high-risk endpoints (such as `env`, `beans`, or `heapdump`) without deliberate access control.
#Metadata
#Why it matters
Over-exposed actuators leak configuration, secrets material, and JVM internals that attackers can use to pivot or crash the service.
#Remediation
Replace wildcards with explicit endpoint lists, move sensitive endpoints off public networks, and pair exposure with Spring Security rules or management port isolation.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/java/java.security.spring-actuator-sensitive-exposure.rule.yaml.