Scenario 19: A security audit flags that /actuator/heapdump and /actuator/env are reachable from the public internet on your production Spring Boot service.

This is a Security Misconfiguration (OWASP): several Actuator endpoints can leak secrets (environment variables, memory contents) or allow disruptive actions if left exposed without protection. Fix by restricting Actuator to a separate internal management port not exposed publicly, and/or explicitly securing sensitive actuator endpoints behind authentication with a dedicated SecurityFilterChain matcher.