Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

docs/output/03-open-actuator-leak.txt

@@ -0,0 +1,39 @@
+### profiles: exposeall,open   -- NO credentials are sent on any request below
+
+--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---
+$ curl -s http://localhost:8080/actuator/env/spring.datasource.password | jq .property
+{
+  "source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
+  "value": "******"
+}
+$ curl -s http://localhost:8080/actuator/env/acme.partner.credential | jq .property
+{
+  "source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
+  "value": "******"
+}
+
+  Note the second one. 'acme.partner.credential' matches none of the classic
+  password/secret/token key patterns, and it is still masked. Masking is driven by
+  management.endpoint.env.show-values, which defaults to 'never' - not by key names.
+
+--- 2. /actuator/heapdump is NOT exposed by 'include: "*"' ---
+$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/heapdump
+404
+  management.endpoint.heapdump.access defaults to 'none'. So does shutdown.
+  They are the only two endpoints that do.
+
+--- 3. /actuator/loggers: an unauthenticated WRITE ---
+$ curl -s -X POST -d '{"configuredLevel":"TRACE"}' -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
+  status=204
+$ curl -s http://localhost:8080/actuator/loggers/org.springframework
+{
+    "configuredLevel": "TRACE",
+    "effectiveLevel": "TRACE"
+}
+  (level reset). An attacker who can flip your root logger to TRACE has both a
+  denial-of-service primitive and a way to get request bodies written to disk.
+
+--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---
+$ curl -s http://localhost:8080/actuator/mappings | python3 -c 'count the URL patterns'
+  30 servlet mappings disclosed
+  426 beans disclosed, each with its type and dependencies