SH018: Spring Boot management or debug endpoints exposed

Severity: high · Category: security · Applies to: spring

Why it matters

Actuator endpoints such as env, heapdump and beans reveal configuration, secrets in memory and the application's structure, and /shutdown can stop the service. The H2 console and stack traces in error responses hand attackers the same kind of detail.

How to fix

Expose only health and info over HTTP, put the rest behind authentication or a separate management port, and turn the H2 console and stack traces off.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH018

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH018