Back

A nice text from @meistermeier which classifies the role of the Spring Actuator in the Volkswagen hack and shows that Spring Boot does not provide default heap dumps in production.
The only thing I would add is that in our last Spring projects we used routing in K8S to ensure that the actuator endpoints could not be accessed from the Internet at all, but only from the K8S health check and localhost

https://meistermeier.com/2024/12/28/spring-actuator-security.html