Actuator Endpoints in Spring Boot: Allowlist, Don't Just Disable the Obvious Ones

Spring Boot Actuator exposes more by default than most teams realize. The difference between an endpoint that's useful for monitoring and a map of environment variables handed to an attacker comes down to a decision almost nobody makes explicitly: allowlist versus disabling what looks obvious.