Spring Boot's default sanitizer masks password, secret, and token. But if your team names things differently, /actuator/env shows them in plain text. Here's the criterion for closing that gap without killing the endpoint.
Sep 11 2026 · 7′ · Tutorials · spring-boot · java
Spring Boot Actuator exposes more by default than most teams realize. The difference between an endpoint that's useful for monitoring and a map of environment variables handed to an attacker comes down to a decision almost nobody makes explicitly: allowlist versus disabling what looks obvious.
Aug 23 2026 · 8′ · Tutorials · spring-boot · java
Stateless JWT isn't the universal answer tutorials promise. If your system needs immediate revocation or fine-grained auditing, state isn't the enemy — it's the solution. Here's the decision framework I use in real identity systems.
Aug 18 2026 · 9′ · Tutorials · seguridad · JWT
Actuator isn't the problem. Enabling it without a clear exposure policy is. A practical guide to using it as an operational tool without turning it into unnecessary public attack surface.
Jun 17 2026 · 8′ · Tutorials · devops · backend
Locking down Actuator endpoints isn't enough. After the incident, I rebuilt the authorization model from scratch: explicit SecurityFilterChain, separate health groups, roles for /metrics and /env, and real validation with curl. This is what's still standing.
May 12 2026 · 7′ · Experiments · devops · backend
After publishing my Jakarta EE vs Spring Boot analysis, I audited Actuator's defaults on a backend I own and found sensitive endpoints wide open — ones I never consciously configured. Here's the hardening checklist I built afterward.
May 11 2026 · 7′ · Experiments · devops · backend
Architecture, real systems, product decisions and technical lessons. Everything reviewed with my own judgment before it ships.
229 articles published