Why is exposing /actuator/env or /actuator/heapdump to the public internet a real security risk?

/actuator/env can leak configuration values including secrets, and /actuator/heapdump hands out a full memory dump an attacker can mine for credentials and session tokens — production configuration should expose only health/info/metrics publicly and require authentication for anything sensitive.