### profiles: exposeall,open   -- NO credentials are sent on any request below

--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---
$ curl -s http://localhost:8080/actuator/env/spring.datasource.password | jq .property
{
  "source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
  "value": "******"
}
$ curl -s http://localhost:8080/actuator/env/acme.partner.credential | jq .property
{
  "source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
  "value": "******"
}

  Note the second one. 'acme.partner.credential' matches none of the classic
  password/secret/token key patterns, and it is still masked. Masking is driven by
  management.endpoint.env.show-values, which defaults to 'never' - not by key names.

--- 2. /actuator/heapdump is NOT exposed by 'include: "*"' ---
$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/heapdump
404
  management.endpoint.heapdump.access defaults to 'none'. So does shutdown.
  They are the only two endpoints that do.

--- 3. /actuator/loggers: an unauthenticated WRITE ---
$ curl -s -X POST -d '{"configuredLevel":"TRACE"}' -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
  status=204
$ curl -s http://localhost:8080/actuator/loggers/org.springframework
{
    "configuredLevel": "TRACE",
    "effectiveLevel": "TRACE"
}
  (level reset). An attacker who can flip your root logger to TRACE has both a
  denial-of-service primitive and a way to get request bodies written to disk.

--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---
$ curl -s http://localhost:8080/actuator/mappings | python3 -c 'count the URL patterns'
  30 servlet mappings disclosed
  426 beans disclosed, each with its type and dependencies