Spring Boot Actuator: What to Expose, What to Hide, and What to Check Before Adding Endpoints

Actuator isn't the problem. Enabling it without a clear exposure policy is. A practical guide to using it as an operational tool without turning it into unnecessary public attack surface.